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ABSTRACT 


Although  perhaps  not  so  dramatic  or  newsworthy  as  chemical,  biologic,  radiologic, 
nuclear,  or  explosive  attacks,  intentionally  set  fires  are  identified  security  threats  to 
federal  buildings  accessible  to  the  public.  The  Department  of  Homeland  Security 
Interagency  Security  Committee  in  2010  adopted  building  construction  standards  that 
purport  to  give  facility  safety  committees  and  building  designers  guidance  on  developing 
pennanent  countenneasures  to  3 1  diverse  threat  scenarios  described  in  the  Design-Basis 
Threat. 

To  assess  the  effectiveness  of  the  permanent  countermeasures  options  provided  in 
the  Physical  Security  Criteria  for  Federal  Facilities,  a  performance-based  approach  to 
evaluating  the  design  and  construction  features  is  recommended.  Clearly  articulated 
perfonnance  objectives  and  quantifiable  characterization  of  the  hazardous  elements 
comprising  the  threat  scenarios  are  essential  to  evaluating  outcomes  using  a  performance- 
based  design  approach. 

A  mixed  methods  research  approach  is  used  to  analyze  the  Physical  Security 
Criteria  for  Federal  Facilities  standard  to  make  policy  recommendations  that  may 
enhance  occupant  safety  and  federal  property  protection  from  arson  attacks. 
Computerized  fire  effects  modeling  is  used  to  compare  outcomes  in  non-military  and 
non-postal  federal  facilities  from  a  variety  of  simulated  arson  scenarios  using  commonly 
available  accelerants. 
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AE 

Anticipated,  expected 

ALF 

Animal  Liberation  Front 

ANFO 

Ammonium  nitrate-Fuel  Oil 

ASET 

Available  Safe  Egress  Time 

ASTM 

ASTM  International1 

BATFE 

Bureau  of  Alcohol,  Tobacco,  Firearms  and  Explosives 

BEU 

Beyond  Extremely  Unlikely 

BSC 

Building  Security  Committee 

Btu 

British  Thennal  Unit 

C 

Celsius 

cal 

Calorie 

CBR 

Chemical,  Biological  or  Radioactive 

CBRN 

Chemical,  Biological,  Radioactive,  or  Nuclear 
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Chemical,  Biological,  Radioactive,  Nuclear,  or  Explosive 

CCTV 

Closed  Circuit  Television 

CFD 

Computational  Fluid  Dynamics 

CO 
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Continuity  of  Government 
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Continuity  of  Operations  Plan 

CUI 

Controlled,  Unclassified  Infonnation 
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Design-Basis  Threat 
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Department  of  Homeland  Security 
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Department  of  Energy 
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Department  of  Justice 
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1  Formerly  the  American  Society  for  Testing  and  Materials. 
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-  Before 

2002,  GAO  was  known  as  the  General  Accounting  Office.  See  31  U.S.C.  §  702. 
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I.  INTRODUCTION 


The  federal  government  is  the  largest  real  property  manager  in  the  United  States. 
Overall,  it  owns  or  leases  more  than  3.34  billion  square  feet  (3.10296x10‘  m  )  of  property 
among  429,000  buildings  used  by  24  government  agencies3  (U.S.  General  Services 
Administration,  2010b).  To  provide  tenants,  workers,  residents,  and  visitors  a  degree  of 
protection  from  threats  to  their  health,  safety,  and  welfare  while  they  occupy  these 
structures,  these  buildings  are  required  by  federal  law  to  meet  minimum  construction 
standards. 

In  the  United  States,  federal  building  design  and  construction  for  the  last  50  years 
were  based  on  prescriptive  standards.  While  these  regulations  generally  have  served  well 
in  protecting  occupants  and  buildings,  the  changing  nature  of  adversaries  and  their  tactics 
demands  a  new  approach  to  federal  asset  protection.  In  1995,  the  federal  government 
began  a  transition  to  risk-based  security  planning  and  decision  making  to  protect  public 
buildings.  That  transition  can  be  enhanced  to  meet  dynamic  threats  by  embracing  the 
precepts  of  perfonnance-based  design. 

A.  PROBLEM  STATEMENT 

Most  contemporary  U.S.  building  designs  are  prescriptive,  in  that  they  must 
comply  with  specific  safety  rules  and  features  prescribed  within  building  codes.  Although 
codes  do  not  specify  how  buildings  are  designed,  they  limit  architectural  options. 
Designers  must  comply  with  a  stringent  framework  of  regulations  that  do  not  address 
specific  threats  nor  provide  predictable  or  measurable  outcomes  in  response  to  specific 
threats  or  vulnerabilities.  Why  are  prescriptive  designs  a  problem?  They  offer  generic 
solutions  that  may  not  adequately  address  the  overall  threats,  vulnerabilities,  risks,  and 
hazards  needed  to  create  a  resilient  facility. 


3  This  study  is  limited  to  the  approximately  9,000  non-military,  non-postal  buildings  controlled  by  the 
General  Services  Administration. 
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Following  the  April  20,  1995,  domestic  terrorist  bombing  of  the  Alfred  P.  Murrah 
Building  in  Oklahoma  City,  the  U.S.  Department  of  Justice  was  tasked  to  assess  the 
vulnerability  of  federal  office  facilities  to  terrorism  and  acts  of  violence.  A  series  of 
subsequent  federal  efforts  have  developed  a  risk-based  model  to  assess  and  improve 
facility  security.  The  Physical  Security  Criteria  for  Federal  Facilities  (2010)  employs  a 
risk-based  approach  to  assign  permanent  countermeasures  to  a  variety  of  pre-scripted 
adversarial  and  terrorist  threat  scenarios.  Once  the  security  threat  level  is  established 
through  a  ranking  protocol,  the  risk-based  model  directs  the  tenant  Facility  Security 
Committee  (FSC)  to  select  permanent  countermeasures  from  a  table  of  prescriptive 
options  intended  to  minimize  risk,  or  the  FSC  may  simply  accept  the  risk.  The  mix  of 
perfonnance-based  risk  assessment  and  prescriptive  solutions  is  irrational. 

Risk  includes  the  probability  of  an  event  and  its  impact.  To  evaluate  risk 
adequately,  threats,  vulnerabilities,  and  consequences  must  be  quantified.  The 
Interagency  Security  Committee  (ISC)  Design-Basis  Threat  (DBT)  and  Physical  Security 
Criteria  for  Federal  Facilities  standards  are  policy  documents  that  describe  3 1  different 
terrorist  scenarios  and  provide  limited  design  options  to  address  each  one.  In  a  few  cases, 
the  asymmetric  threat  scenarios  are  clearly  articulated  and  quantified  so  a  physical 
security  specialist  could  develop  meaningful  countermeasures.  For  example,  the  scenario 
for  a  mailed  or  delivered  explosive  device  states  the  device  likely  will  “be  packaged  in  a 
large,  padded  shipping  enveloped  or  small  box  containing  not  less  than  100  grams  of 
TNT4  or  TNT  equivalent”  (U.S.  Department  of  Homeland  Security,  2010c).  Knowing  the 
size  of  the  explosive  component,  a  physical  security  specialist  can  assess  the  impact  of 
the  shock  wave,  its  travel  distance,  its  velocity,  and  the  likelihood  of  death,  injury,  and 
damage  within  a  certain  radius  of  the  device. 


4  Tri-nitro-toluene,  a  common  high  explosive. 
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The  Physical  Security  Criteria  for  Federal  Facilities  ’  pre-scripted  threat  scenarios 
include  this  one  for  arson:5  “An  adversary  places  an  improvised  incendiary  device  (IID) 
containing  an  accelerant  and  utilizing  a  delay  mechanism  adjacent  to  a  facility,  but 
outside  the  view  of  security  countermeasures.”  While  this  covert  threat  may  sound 
dramatic,  it  is  ill  defined  and  not  measurable.  The  size  of  the  device,  the  physical  and 
chemical  nature  of  the  accelerant,  the  volume  or  weight  of  the  accelerant,  the  distance 
from  the  facility,  and  the  facility  type  of  construction  are  not  defined;  therefore,  a 
meaningful  risk  assessment  cannot  be  performed  and  suitable  pennanent 
countenneasures  cannot  be  identified  and  applied.  A  performance-based  design  method 
would  allow  the  security  team  to  define  a  range  of  threats,  assess  their  potential  effects, 
and  evaluate  specific  countenneasures  most  suited  to  address  them. 

Arson  is  a  security  and  tenorist  threat  to  federal  buildings  and  facilities  in  the 
United  States.  According  to  Baird  (2006),  “historical  analysis  of  incidents  coupled  with 
open  source  information  reveals  that  tenorist  groups  in  general  are  adapting  toward 
simple  destructive  methods  like  arson  with  increasingly  high  levels  of  fatalities”  (p.  416). 
As  recently  as  May  31,  2012,  the  Department  of  Homeland  Security  National  Operations 
Center  issued  a  warning  that: 

International  terrorist  groups  and  violent  extremists  have  long  shown 
interest  in  using  fire  as  a  weapon  due  to  the  low  cost  and  limited  technical 
expertise  required,  the  potential  for  causing  large-scale  damage,  and  the 
low  risk  of  apprehension.  Recent  encouragement  of  use  of  this  tactic  by 
terrorist  groups  and  violent  extremists  in  propaganda  materials  and 
extremist  web  forums  is  directed  at  Western  audiences  and  supports 
Homeland  attacks.  (U.S.  Department  of  Homeland  Security  Office  of 
Intelligence  and  Analysis,  2012,  p.  2) 

On  February  14,  2012,  a  homeland  security  fusion  center  reported  intelligence 
that  an  alleged  member  of  an  Iraqi  terrorist  organization  was  plotting  to  burn  Federal 
Emergency  Management  Agency  buildings  throughout  the  United  States  (Maryland 


5  Arson  is  a  common  law  term  that  describes  the  crime  of  using  fire  to  injure  persons  or  damage 
property.  In  the  fire  protection  field,  “incendiarism”  defines  the  act  of  intentional  fire  setting  regardless  of 
criminal  intent.  Since  the  ISC  uses  the  term  arson  to  describe  intentionally  set  fires,  it  is  used 
synonymously  with  incendiarism  in  this  thesis. 
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Coordination  and  Analysis  Center,  2012).  Overall,  arson  in  the  United  States  accounted 
for  an  estimated  210,300  intentionally  set  fires  each  year  from  2004  to  2006,  the  most 
recent  years  for  which  data  is  available.  Intentionally  set  fires  accounted  for  13%  of  fires 
reported  by  fire  departments  in  the  United  States.  These  fires  resulted  in  an  average  of 
approximately  375  deaths,  1,300  injuries,  and  $1.06  billion  in  property  loss  each  year 
(U.S.  Fire  Administration,  2009).  In  non-military  and  non-postal  federally  owned  or 
leased  properties  alone,  from  2008  to  2010,  51  structural  fires  caused  $10,647,586  in 
damage.  More  than  5%  of  these  fires  were  attributed  to  arson  or  domestic  terrorist  attack 
(J.  Elvove,  personal  communication.  May  10,  2011).  Table  1  provides  a  summary  of  the 
fire  incident  data  reported  to  the  General  Services  Administration  (GSA)  in  non-military 
and  non-postal  federal  facilities6  during  that  period. 


Table  1.  Fire  Incidents:  GSA  Federal  Facilities:  2008-2010  (From:  J.  Elvove, 

personal  communication.  May  10,  201 1) 


Property  type 

2010 

Year 

2009 

2008 

Total 

%  Total 

Office 

14 

14 

16 

44 

80.0 

Courthouse 

0 

1 

5 

6 

10.9 

Retail  space 

0 

0 

1 

1 

1.8 

Mobile3 

1 

2 

1 

4 

7.3 

Total 

15 

17 

23 

55 

100.0 

aMobile  properties  include  mobile  equipment:  movable  under  its  own  power,  or 
towed,  such  as  an  airplane,  automobile,  boat,  cargo  trailer,  farm  vehicle,  motorcycle, 
or  recreational  vehicle,  and  are  outside  the  scope  of  this  study. 


The  predominant  cause  of  fires  in  these  facilities  was  some  sort  of  electrical 
problem:  faulty  wiring,  poor  maintenance,  or  improperly  used  equipment.  Table  2 
provides  a  breakdown  by  ignition  source  of  the  structural  fires  reported  to  the  GSA 
during  the  2008-2010  period. 


6  The  Administrator  of  GSA  is  responsible  for  the  construction  and  maintenance  of  non-military  and 
non-postal  federal  facilities.  See  40  U.S.C.  §  3302  (2010)  and  40  U.S.C.  §  581  (2010). 
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Table  2.  Fire  Causes:  GSA  Federal  Facilities:  2008-2010  (From:  J.  Elvove,  personal 

communication,  May  10,  201 1) 


Ignition  source 

2010 

Year 

2009 

2008 

Total 

%  Total 

Arson/incendiary 

0 

1 

1 

2 

3.6 

Cooking 

0 

0 

4 

4 

7.3 

Electrical  lighting/equipment 

12 

11 

13 

36 

65.5 

Welding/cutting 

1 

1 

2 

4 

7.3 

Domestic  terror  attack3 

1 

0 

0 

1 

1.8 

Other 

1 

4 

3 

8 

14.5 

Total 

15 

17 

23 

55 

100.0 

Note.  Data  includes  mobile  properties. 

JPrivate  airplane  flown  into  office  building,  Austin,  Texas,  February  18,  2010. 


Despite  the  fact  the  data  overwhelmingly  shows  that  in  the  2008-2010  timeframe 
the  leading  cause  of  fire  in  non-military,  non-postal  federal  buildings  was  some  sort  of 
electrical  malfunction,  concern  exists  regarding  malicious  acts  against  federal  properties. 
According  to  the  ISC  DBT,  the  baseline  threat  to  federal  facilities  from  the  described  IID 
event  is  assessed  to  be  high  (U.S.  Department  of  Homeland  Security,  2010c). 

For  the  purpose  of  this  study,  no  distinction  occurs  between  the  use  of  the  terms 
fire  and  arson.  Fire  is  a  complex  chemical  reaction  generally  involving  a  fuel,  an 
oxidizing  agent,  and  a  competent  heat  source,  and  arson  is  a  legal  term  to  describe  a 
criminal  act — the  consequence  of  which  is  a  fire  or  explosion.  Fires  may  occur  as  the 
result  of  a  natural  event,  such  as  a  lightning  strike  in  light  grassy  fuels,  or  as  the 
unintentional  result  of  a  mechanical  malfunction,  such  as  overheating  equipment  or  an 
electrical  spark.  Likewise,  fires  can  result  from  human  error,  such  as  discarding  burning 
debris  or  by  misusing  of  flammable  products  around  heat  sources.  The  outcome  of 
unintentional  fires  or  those  intentionally  set  may  be  the  same:  unwanted  heat,  smoke, 
property  damage,  injury,  or  death. 

While  improvised  explosive  devices  (IED)  often  are  the  primary  focus  of  federal 
security  professionals  trying  to  protect  assets  from  a  terrorist  attack,  a  direct  link  does 
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exist  between  IED  and  fire.  The  instantaneous  oxidation  that  occurs  when  an  IED 
explodes  is  the  same  chemical  reaction  that  occurs  in  a  fire;  only  the  speed  with  which 
the  chemical  reaction  and  ensuing  shock  wave  occur  are  different.  Furthermore,  the 
instantaneous  oxidation  of  an  IED  may  be  the  trigger  for  a  secondary,  firebomb-type 
device.  The  car  bomb  parked  May  2,  2010  by  Faisal  Shahzad  in  New  York  City’s  Times 
Square  contained  10  gallons  (37.8  L)  of  gasoline  and  three  25-pound  (23.6  L)  liquefied 
petroleum  gas  cylinders.  According  to  Williams  and  Dienst  (2010),  while  a  test 
conducted  by  the  Federal  Bureau  of  Investigation’s  (FBI)  Operational  Technology 
Division  could  not  calculate  the  firebomb’s  exact  explosive  force,  its  effects  likely  would 
have  killed  scores  of  people. 

A  second  shortcoming  of  the  Physical  Security  Criteria  for  Federal  Facilities 
approach  is  its  emphasis  on  threats  it  calls  “primarily  manmade.”  According  to  the  report, 
“other  threats  to  buildings,  such  as  earthquakes,  fire,  or  storms  are  beyond  the  scope  of 
this  document  and  are  addressed  in  applicable  construction  standards  [italics  added], 
although  many  of  the  countenneasures  identified  will  contribute  to  mitigating  natural 
hazards”  (U.S.  Department  of  Homeland  Security,  2010c).  This  approach  presumes  the 
applicable  construction  standards — the  model  building  codes — are  adequate  to  protect 
against  these  and  other  natural  hazards.  Many  technological  hazards — such  as  fires,  gas 
leaks,  and  other  hazardous  materials  releases — are  both  manmade  and  an  equal  or  greater 
threat  than  terrorist  attacks.  To  provide  comprehensive  physical  security  for  federal 
facilities,  all  hazards  and  threats  should  be  addressed  by  the  nature  of  the  destructive 
potential. 

B.  RESEARCH  QUESTIONS 

1.  Primary  Research  Question 

How  can  the  U.S.  Department  of  Homeland  Security  (DHS)  ISC  Physical 
Security  Criteria  for  Federal  Facilities  standard  employ  performance-based  design 
methods  to  evaluate  the  effectiveness  of  its  pennanent  countenneasure  options  to  arson 
threats? 
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2.  Secondary  Research  Questions 


How  can  the  arson  threat  scenario  described  in  the  DBT  be  quantified  for  the 
purposes  of  selecting  permanent  countenneasures? 

Are  the  design  methods  published  in  the  Society  of  Fire  Protection  Engineers 
(SFPE)  SFPE  Engineering  Guide  to  Performance  Based  Fire  Protection  or  the 
International  Code  Council  (ICC)  Performance  Code  for  Buildings  and  Facilities  suitable 
tools  to  evaluate  pennanent  countermeasure  options  to  quantified  arson  threats? 

Should  the  ISC  reports  Physical  Security  Criteria  for  Federal  Facilities  and  the 
DBT  be  limited  to  criminal  or  manmade  threats  as  stated  in  the  documents? 

C.  HYPOTHESIS 

DHS  ISC  was  created  to  produce  physical  security  standards  for  non-military  and 
non-postal  federal  facilities.  It  has  developed  a  risk-based  analytical  approach  to  assess 
the  protection  of  federal  employees  and  property  from  manmade  threats.  The  approach  is 
intended  to  give  in  situ  FSC  members  a  means  to  evaluate  the  level  of  protection  needed 
based  on  an  assessment  of  the  facility’s  overall  vulnerability  to  one  or  more  threats. 
While  the  risk-based  approach  employs  an  easy-to-follow  process,  some  threat  scenarios 
do  not  provide  enough  infonnation  to  permit  a  rational  evaluation  of  the  outcome. 

The  ISC  DBT  and  Physical  Security  Criteria  for  Federal  Facilities  standards  are 
policy  documents  that  describe  a  condensed  description  of  3 1  different  threat  scenarios 
and  provide  limited  design  solutions  to  address  each  one.  In  some  cases,  the  threat 
scenarios  are  clearly  articulated  and  quantified  so  a  physical  security  specialist  could 
develop  meaningful  countenneasures.  In  the  arson  scenario,  the  description  is  so  vague 
that  threat-specific  countermeasures  cannot  be  developed. 

Arson  as  a  means  of  attack  on  federal  facilities  remains  a  vulnerability  that  should 
be  addressed  in  federal  construction  practices  to  minimize  hazards  to  occupants’  lives, 
damage  to  taxpayer-owned  property,  and  the  interruption  of  essential  government 
services.  Current  building  and  fire  codes  are  predicated  on  a  single  fire  event  that  occurs 
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in  or  near  a  structure,  and  built-in  fire  protection  features  are  expected  to  control  the  fire 
to  a  reasonable  degree.  An  arsonist  armed  with  large  quantities  of  highly  flammable 
materials — or  one  who  manages  to  set  multiple  fires  within  or  near  a  structure — creates 
events  not  anticipated  in  contemporary  codes  and  construction  methods.  Specific 
countermeasures — based  on  the  anticipated  threat — are  needed  to  provide  successful 
event  outcomes  as  defined  by  those  affected. 

In  its  assessment  of  the  arson  threat,  the  DBT  cites  Federal  Bureau  of 
Investigation  Uniform  Crime  Reporting  data  and  DHS’  Federal  Protective  Service  (FPS) 
records  that  indicate  from  2007  through  2010,  nine  arson  cases  were  reported  at 
approximately  9,000  GSA  properties.7  While  the  scale  and  history  have  not  been 
significant,  the  DBT  acknowledges  the  arson  threat  to  federal  facilities  is  viable. 

Based  on  the  unsophisticated  nature  of  the  attack,  availability  of  specific 
information  on  planning  and  executing  such  an  attack,  the  historical 
frequency  of  its  use  in  general  and  specifically  against  Federal  facilities, 
and  demonstrated  intent  by  terrorist  organizations  to  utilize  this  tactic 
against  Federal  facilities,  the  baseline  threat  to  Federal  facilities  is 
assessed  to  be  HIGH  [emphasis  in  original  text],  (U.S.  Department  of 
Homeland  Security,  2010c) 

Terrorist  and  adversarial  threats  are  dynamic;  perpetrators  probe  to  find 
weaknesses  in  security  plans  and  countermeasures.  Threats  and  tactics  change  over  time. 
Improvised  weaponry  evolves  over  time  and  becomes  more  sophisticated  and  harder  to 
detect.  Even  technological  hazards — dismissed  in  the  Physical  Security  Criteria  for 
Federal  Facilities  as  beyond  the  scope  of  the  document — change  with  growth  in 
technology,  industry,  and  markets.  Using  design-basis  threat  scenarios  that  lead  to  a 
limited  number  of  permanent  countermeasure  options  is  shortsighted  and  contrary  to 
meaningful  security.  If  the  Physical  Security  Criteria  for  Federal  Facilities  standard  and 
its  supporting  DBT  were  amended  to  employ  performance-based  design  methods  using 
quantified  arson  threats,  then  threat-specific  permanent  countenneasures  could  be  defined 
to  mitigate  the  consequences. 


7  Chapter  VII  addresses  vagaries  in  data  collection  and  reporting. 
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An  analysis  of  these  two  ISC  policies  will  reveal  that  their  current  design-basis 
and  permanent  countermeasure  strategies  do  not  provide  facility  security,  architecture,  or 
design  teams  meaningful  criteria  against  which  a  proposed  design  can  be  measured.  The 
policies  are  lacking  fundamental  criteria  to  explain  the  differences  among  arson  attack 
methods,  the  nature  of  the  potential  weaponry,  the  potential  for  damage,  and  the 
effectiveness  of  the  countermeasures  included  as  design  options  in  the  standards  that 
should  be  employed. 

As  a  result  of  the  policy  analysis,  it  is  anticipated  that  recommendations  will  be 
made  to  adopt  one  or  more  elements  of  the  perfonnance-based  design  methods  of  the 
SFPE  or  ICC  used  to  address  specific  fire  problems  that  start  with  the  quantification  of 
the  potential  fire  threat  and  developing  scientific  and  engineering-based  design  solutions 
to  control  or  mitigate  the  event.  The  analysis  may  reveal  that  perfonnance-based  design 
methods  could  be  applied  to  the  other  30  threat  scenarios  described  in  the  DBT. 

The  opportunity  exists  from  this  research  to  influence  the  application  of  a  policy 
that  addresses  threat  quantification  among  all  the  31  design  scenarios.  Each  of  the 
scenarios  could  provide  measurable  parameters  that  would  allow  physical  security 
specialists  to  assess  the  threat  fully. 

D.  METHOD 

The  development  of  federal  administrative  policies  is  a  complex  process 
involving  many — and  sometimes  competing — interests.  The  creation  of  the  Physical 
Security  Criteria  for  Federal  Facilities  standard  was  the  work  of  participants  from  more 
than  20  agencies  representing  law  enforcement,  building  construction  and  management, 
security,  diplomacy,  intelligence,  education,  human  health,  finance,  and  environmental 
protection.  Given  the  range  of  professional  disciplines  involved,  traditional  quantitative 
or  qualitative  research  methods  may  not  fully  address  the  breadth,  complexity,  and 
synergy  of  this  effort.  To  get  a  more  complete  picture  to  perform  better  policy  analysis,  a 
variety  of  research  methods  are  desirable. 
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Bardach  (2009)  described  the  evolving  nature  of  policy  analysis  where  the 
traditional  image  of  the  policy  wonk  buried  deep  in  a  bureaucracy  producing  periodic  and 
detailed  reports  for  decision  makers  has  been  replaced  by  policy  analysts  who  work  in 
cross-agency  teams  in  loose  networks  that  cut  across  organizational  lines,  which  is 
precisely  how  the  Physical  Security  Criteria  for  Federal  Facilities  standard  was 
developed. 

An  evolving  research  method  is  applicable  to  evaluate  this  multi-discipline 
product,  which  is  mixed  methods  research.  Johnson  and  Onwuegbuzie  (2004)  defined 
mixed  methods  research  as  “the  class  of  research  where  the  researcher  mixes  or  combines 
quantitative  and  qualitative  research  techniques,  methods,  approaches,  concepts  or 
language  into  a  single  study”  (p.  17).  They  further  stated  that  the  goal  of  mixed  methods 
research  is  not  to  replace  either  quantitative  or  qualitative  research  approaches,  but  to 
“draw  from  the  strengths  and  minimize  the  weaknesses  of  both  in  single  research  studies 
and  across  studies”  (pp.  14-15).  Greene,  Caracelli,  and  Graham  (1989)  reported  that  one 
of  the  five  primary  reasons  for  employing  mixed  methods  research  was  triangulation, 
which  is  the  comparison  of  findings  from  different  methods  to  interpret  the  phenomenon 
under  study. 

The  policy  outcome  to  address  these  aforementioned  shortcomings  of  prescriptive 
design  solutions  may  be  to  adopt  and  apply  the  methods  of  performance-based  design  for 
fire  safety.  Perfonnance-based  design  employs  a  rigorous  multi-step  system  that 
articulates  the  desired  perfonnance  end-state  (the  anticipated  level  of  protection  from  the 
threat),  and,  using  scientific  and  engineering  tools,  offers  design  options  to  achieve  it. 
Performance-based  design  methods  also  embrace  stakeholder  accountability  from 
programmatic  concept,  through  design  and  construction,  to  implementation,  and 
ultimately,  to  on-going  maintenance.  Stakeholders,  both  the  Federal  Security  Committee 
and  tenants,  play  a  key  role  in  defining  and  solving  the  desired  end-state. 

The  policy  analysis  approach  was  selected  to  dissect  and  evaluate  the  existing 
policy  (the  Physical  Security  Criteria  for  Federal  Facilities  standard  and  its  supporting 
DBT  with  the  intent  of  identifying  potential  shortcomings  and  improvements  during  the 
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validation  period.  Policy  analysis  is  expected  to  explore  several  ISC  self-acknowledged 
shortcomings,  as  well  as  weaknesses  in  the  use  of  the  arson  design  basis  threat  currently 
specified  in  the  document.  Policy  analysis  will  compare  the  methods  described  in  the  two 
documents  to  methods  employed  in  the  developing  field  of  perfonnance-based  design. 

The  policy  analysis  approach  will  examine  a  number  of  the  assumptions  that 
underlie  the  problem  statement.  The  most  important  consideration  is  that  without  clearly 
articulated  design  parameters,  a  desired  end-state  (level  of  protection)  cannot  be 
identified,  nor  its  risk  measured.  Importing  a  poorly  defined  threat  into  a  risk  analysis 
model  prevents  its  users  from  developing  measurable  outcomes. 

To  supplement  the  analysis,  two  prototypical  facility  scenarios  are  created 
representing  federal  facility  configurations,  and  the  designs  are  subjected  to  simulated 
fires  using  state-of-the-art  fire  modeling  software.  The  model  results  are  compared  and 
evaluated  for  performance  with  the  expectation  that  the  current  DBT  arson  scenario  is 
unsatisfactory  to  achieve  meaningful  permanent  countermeasures. 

E.  RESEARCH  SIGNIFICANCE 

This  thesis  serves  to  fill  a  gap  in  the  literature  pertaining  to  the  application  of 
perfonnance-based  design  for  federal  facilities,  with  the  potential  for  transfer  to  other 
government  and  private  sector  real  property.  Much  of  the  literature  on  performance-based 
design  is  anticipatory  as  to  how  performance-based  design  approaches  might  be  used,  but 
the  United  States  still  has  minimal  experience  with  the  method  as  a  means  of  building 
design,  construction,  and  performance  evaluation. 

Furthermore,  this  thesis  serves  as  a  foundation  for  additional  research  in  the 
application  of  performance-based  design  to  terrorist  and  criminal  threats  other  than  arson, 
a  number  of  which  are  articulated  in  the  DBT.  By  being  able  to  quantify  the  scale,  scope, 
and  potential  outcomes  of  various  threat(s),  the  design  and  engineering  community  can 
strive  to  develop  measurable  protective  strategies  and  designs  to  mitigate  the  threat  and 
consequences. 
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The  changing  nature  of  terrorist  tactics  and  threats — as  well  as  those  dismissed  as 
manmade — requires  a  robust  method  that  can  evaluate  the  efficacy  of  proposed 
countenneasures  for  facility  safety  before  they  are  implemented  at  sometimes  significant 
costs  to  taxpayers.  As  such,  this  thesis  may  be  useful  to  the  DHS  ISC,  the  GSA  and  other 
federal  agencies  that  acquire,  construct,  or  substantially  remodel  real  property. 

F.  CHAPTER  OVERVIEW 

Following  this  introduction,  Chapter  II  reviews  recent  literature  pertaining  to 
federal  facility  protection,  federal  construction  regulations,  performance-based  design 
and  building  construction,  computerized  fire  models,  and  the  policy  implications  of 
performance-based  design. 

Chapter  III  explains  the  history  of  the  development  of  the  DHS  ISC  as  it  has 
evolved  from  the  1995  Department  of  Justice  courthouse  and  office  building  vulnerability 
study  to  where  it  has  come  in  2012. 

Chapter  IV  discusses  the  modern  history  of  building  and  fire  codes  in  the  United 
States  to  provide  the  context  for  the  differences  between  prescriptive  and  performance- 
based  codes,  and  how  their  features  can  be  exploited  to  achieve  desirable  design  and 
safety  goals. 

Chapter  V  describes  fire  physics  and  behavior  to  provide  a  foundational 
understanding  of  the  inputs  used  in  the  fire  modeling  analysis. 

Chapter  VI  explains  how  fire  has  been  used  as  a  weapon,  and  the  impact  of 
potential  IID  and  accelerants  on  the  built  environment. 

Chapter  VII  describes  the  mixed  method  research  approach,  including  the 
methods  employed.  It  also  includes  the  foundational  data  and  findings  that  enable  the 
policy  analysis  of  the  Physical  Security  Criteria  for  Federal  Facilities  standard  and  its 
supporting  DBT. 
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Chapter  VIII  provides  the  analysis  and  recommendations  of  these  documents  to 
detennine  whether  the  DHS  ISC  Physical  Security  Criteria  for  Federal  Facilities 
standard  can  employ  perfonnance-based  design  methods  to  evaluate  the  effectiveness  of 
its  pennanent  countermeasure  options  to  arson  threats. 
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II.  LITERATURE  REVIEW 


Research  and  writing  about  the  protection  of  buildings  from  natural  and  manmade 
threats  has  a  long  history  and  a  substantial  body  of  literature  ranging  from  architectural 
and  engineering  design  through  legally  mandated  construction  regulations.  Federally 
owned  properties,  because  of  their  unique  exempt  legal  status  related  to  state  and  local 
building  codes  (based  on  the  supremacy  clause  of  the  U.S.  Constitution),  are  enjoined  by 
the  federal  government’s  own  guidelines.  The  application  of  performance-based  design 
methods  to  federal  properties  offers  architects  and  tenants  alike  a  contemporary  means 
for  evaluating  building  safety.  This  section  reviews  recent  literature  on  construction 
guidance  and  the  elements  of  perfonnance-based  fire  safe  building  design. 

A.  FEDERAL  FACILITY  PROTECTION 

The  acquisition,  management,  and  protection  of  federal  real  property  predate  the 
founding  of  the  republic.  According  to  Kane,  Anzovin,  and  Podell  (1998),  the  first 
building  erected  in  the  United  States  for  public  use  by  the  federal  government  was  a  brick 
structure  for  the  U.S.  Mint  built  on  Seventh  Street  in  Philadelphia.  David  Rittenhouse, 
director  of  the  Mint,  laid  the  cornerstone  on  July  31,  1792. 

The  literature  related  to  the  construction  and  protection  of  federal  facilities  is  vast, 
which  ranges  from  federal  laws  through  agency  policy  to  administrative  implementation 
guidelines.  In  the  context  of  this  study,  the  literature  related  to  physical  security  and  fire 
protection  in  the  modem  era  begins  with  the  Federal  Property  and  Administrative 
Services  Act  of  1949  (40  U.S.C  §  101  et.  seq.).  This  law  applies  to  the  acquisition  and 
management  of  property  held  by  most  government  agencies  and  assigns  responsibility  for 
real  property  to  the  Administrator  of  General  Services.  Numerous  agencies,  such  as  the 
Department  of  Defense,  the  United  States  Coast  Guard,  the  National  Aeronautical  and 
Space  Administration,  both  houses  of  Congress,  and  the  White  House,  are  among  many 
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of  the  agencies  exempt  from  the  act  (U.S.  Government  Accountability  Office,  2003).  See 
Appendix  C  for  the  definition  of  public  buildings,  the  scope  of  the  Federal  Property  and 
Administrative  Services  Act  of  1949,  and  exceptions  from  it. 

In  1992,  the  U.S.  Congress  amended  the  Federal  Fire  Safety  Act  to  require 
automatic  fire  sprinkler  systems  or  an  equivalent  level  of  safety  in  all  new  or  significantly 
remodeled  six  story  or  taller  federal  office  buildings  (Boucher,  1992).  Congress  also 
required  the  GSA  to  develop  regulations  to  define  the  term  “equivalent  level  of  safety” 
(15  U.S.C.  §  2227  (d)).  The  eventual  result  was  that  designers  were  given  three  options  to 
prove  their  proposal  met  an  equivalent  level  of  safety  to  a  building  with  a  complete 
automatic  sprinkler  system  based  on  the  building  occupants’  ability  to  evacuate  in  a  safe 
manner.  In  the  first  two  alternatives,  a  measurable  margin  of  safety8  would  be  used  to 
detennine  the  acceptability  of  the  alternate  design.  The  first  option  required  that  proposed 
alternate  designs  provide  available  safe  egress  times  equal  to  those  in  a  building  provided 
with  complete  automatic  sprinkler  protection.  The  second  option — recommended  for 
typical  office  scenarios — required  the  designer  to  predict  the  estimated  times  that  a  fire 
would  reach  flashover,9  would  produce  a  heat  release  rate  (HRR)  of  1,000  kilowatts10 
(1  MW),  or  leave  the  room  where  the  fire  began.  The  shortest  of  the  three  times  would 
provide  the  baseline  for  available  escape  time.  If  the  combination  of  proposed  fire 
protection  alternatives  provided  an  adequate  safety  margin,  that  arrangement  could  be 
considered  an  equivalent  level  of  safety.  Finally,  the  third  option  allowed  the  government 
to  accept  other  technical  analysis  procedures  as  long  as  they  were  conducted  in 
accordance  with  recognized  engineering  standards  (U.S.  General  Services 
Administration,  1994). 


8  The  margin  of  safety  is  measured  as  the  difference  between  available  safe  egress  time  and  required 
safe  egress  time.  “Available  safe  egress  time  is  the  time  available  for  evacuation  of  occupants  to  an  area  of 
safety  prior  to  the  onset  of  untenable  conditions  in  occupied  areas  or  the  egress  pathways.  The  required  safe 
egress  time  is  the  time  required  by  occupants  to  move  from  their  positions  at  the  start  of  the  fire  to  areas  of 
safety”  (U.S.  General  Services  Administration,  1994,  p.  52). 

9  The  point  at  which  a  rapid  change  occurs  in  a  developing  room  or  compartment  fire  to  full 
involvement. 

10  HRR  is  a  measure  of  the  energy  released  over  time  by  a  burning  object.  A  1,000-kilowatt  HRR  is 
approximately  equivalent  to  the  energy  emitted  from  a  fully  burning  upholstered  chair. 
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Stroup  (1998)  used  performance-based  design  and  fire  modeling  techniques  to 
evaluate  the  relative  safety  of  two  federal  building  projects,  and  found  that  while  the 
proposed  designs  enhanced  occupant  safety,  additional  research  was  necessary  to  support 
the  use  of  perfonnance-based  design  as  a  means  to  provide  an  equivalent  level  of  safety. 

Six  weeks  after  al  Qaeda  operatives  attacked  the  World  Trade  Center  with 
aircraft,  President  George  W.  Bush  began  issuing  a  series  of  Homeland  Security 
Presidential  Directives  (HSPD)  on  matters  pertaining  to  homeland  security.  On 
December  13,  2003,  the  President  issued  HSPD  7  “Critical  Infrastructure11  Identification, 
Prioritization,  and  Protection”  that  included  a  requirement  that  “all  Federal  department 
and  agency  heads  are  responsible  for  the  identification,  prioritization,  assessment, 
remediation,  and  protection  of  their  respective  internal  critical  infrastructure  and  key 
resources”  12  (Bush,  2003).  HSPD  7  covered  those  federal  facilities  included  within  the 
broad  definition  of  critical  infrastructure. 

Sternberg  and  Lee  (2006)  argued  that  federal  emphasis  on  protecting  other  critical 
infrastructure — typically  described  as  utility  networks,  transportation  systems  and  key 
industrial  sectors — was  a  homeland  security  focus  that  overlooked  the  importance  of 
government  facilities,  which  they  define  as  “large  and  complex  human-occupied 
structures.” 

One  year  after  the  aircraft  terrorist  attacks  on  the  World  Trade  Center,  the  Federal 
Emergency  Management  Agency  (FEMA)  produced  the  first  of  two  documents  intended 
to  help  building  designers  and  occupants  address  the  threat  of  terrorist  attack.  The  first, 
Integrating  Manmade  Hazards  into  Mitigation  Planning  (Federal  Emergency 
Management  Agency,  2002a),  provided  guidance  to  state  and  local  governments  to 
reduce  or  eliminate  life  loss  and  property  damage  from  manmade  disasters.  It  categorized 
human-caused  hazards  as  technological  hazards  or  terrorism.  According  to  the  document, 

1 1  Defined  as  “systems  and  assets,  whether  physical  or  virtual,  so  vital  to  the  United  States  that  the 
incapacity  or  destruction  of  such  systems  and  assets  would  have  a  debilitating  impact  on  security,  national 
economic  security,  national  public  health  or  safety,  or  any  combination  of  those  matters”  (See  USA  Patriot 
Act  of  2001,  42  U.S.C.  §5195  et.  seq.). 

12  Defined  as  “means  publicly  or  privately  controlled  resources  essential  to  the  minimal  operations  of 
the  economy  and  government”  (See  Homeland  Security  Act  of  2002,  6  U.S.C.  §101  et.  seq.). 
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technological  hazards  refer  to  incidents  that  arise  from  routine  human  activities,  such  as 
the  manufacture,  transportation,  storage,  and  use  of  hazardous  materials.  Terrorism,  on 
the  other  hand,  is  defined  as  intentional,  criminal  or  malicious  acts. 

The  second  FEMA  publication,  Reference  Manual  to  Mitigate  Potential  Terrorist 
Attacks  against  Buildings  (Federal  Emergency  Management  Agency,  2003)  described 
building  fire  hazards  as  technological  accidents  addressed  in  existing  building  codes, 
industry  standards,  and  FEMA  guidelines.  The  document  acknowledged  that: 

mitigation  factors  include  built-in  fire  detection  and  protection  systems 
and  fire -resistive  construction  techniques.  Inadequate  security  can  allow 
easy  access  to  target,  easy  concealment  of  an  incendiary  devices,  and 
undetected  initiation  of  a  fire.  Non-compliance  with  fire  and  building 
codes  as  well  as  failure  to  maintain  existing  fire  protection  systems  can 
substantially  increase  the  effectiveness  of  a  fire  weapon.  (2003,  p.  40) 

The  document  provided  a  “Building  Vulnerability  Assessment  Checklist,” 
developed  by  the  U.S.  Department  of  Veterans  affairs  that  compiled  the  best  practices  for 
design  and  construction  based  on  contemporary  technology  and  scientific  research. 
Where  guidance  was  provided  on  fire  safety  vulnerabilities,  all  the  recommended 
solutions  were  based  on  existing  prescriptive  regulations  and  standards. 

B.  GENERAL  SERVICES  ADMINISTRATION  CONSTRUCTION 
REGULATIONS 

The  GSA  is  responsible  for  the  construction  and  management  of  all  federally 
owned  public  buildings  outside  the  District  of  Columbia  and  off  military  reservations.13 
In  2010,  the  GSA’s  Public  Building  Service  (PBS)  reported  it  managed  more  than  8,600 
leased  and  owned  buildings  with  a  gross  floor  area  in  excess  of  351  million  square  feet 
(3.2609  x  10  m  ).  Of  this,  the  GSA  was  responsible  for  more  than  175  million  square 

7  2* 

feet  (1.6258  x  10  m  )  in  more  than  1,500  buildings,  with  the  balance  leased  from  private 


13  See  40U.S.C.  §3101. 
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owners.  The  three  primary  types  of  facilities  are  federal  office  buildings,  courthouses, 
and  land  ports  of  entry14  (U.S.  General  Services  Administration,  2010a,  p.  2).  Clearly, 
the  federal  government  is  a  major  user  and  occupant  of  real  property. 

According  to  the  Commission  on  Engineering  and  Technical  Systems 
(Commission  on  Engineering  and  Technical  Systems,  1989)  “Federal  agencies  are 
exempt  from  these  state  and  local  building  codes  (and  from  zoning  laws  as  well),  and  are 
entirely  responsible  for  all  aspects  of  safety  and  health  in  their  buildings”  (p.  2). 
However,  the  Public  Buildings  Act  of  1988 15  specified  that  any  building  constructed  or 
altered  by  the  GSA  or  any  other  federal  agency  should  be  in  compliance — to  the  extent 
feasible  as  detennined  by  the  GSA  administrator  or  in  the  case  of  national  security 
needs — with  the  latest  published  edition  of  one  of  the  nationally  recognized  model 
building  codes  (Legal  Information  Institute,  2011a).16  Beginning  in  1996,  the  GSA  has 
published  a  series  of  mandatory  design  guides  called  “Facilities  Standards  for  the  Public 
Buildings  Service  (P100)”  (U.S.  General  Services  Administration,  2010a).  Although  not 
a  building  code  in  the  typical  context,  the  PI 00  establishes  GSA  requirements  for  public 
buildings  in  the  general  areas  of  sustainability,  energy  conservation,  physical  security, 
and  health  and  safety. 

In  the  area  of  fire  protection  and  life  safety,  the  PI 00  standard  establishes  a 
perfonnance  goal  to: 

incorporate  into  all  projects  fire  protection  and  life  safety  systems  that  are 
effective  in  detecting,  extinguishing,  or  controlling  a  fire  event,  thereby 
improving  overall  building  safety  to  an  acceptable  level. 


14  See  Appendix  A  for  the  legal  definition  of  “public  buildings.” 

15  See  40  U.S.C.  §3312. 

16  This  legal  mandate  has  been  overtaken  by  events;  in  1988,  three  nationally  recognized  model 
buildings  codes  existed.  Today,  the  GSA  P100  recognizes  only  one:  the  International  Code  Council’s 
International  Building  Code  with  modifications  to  the  means  of  egress  requirements  where  the  National 
Fire  Protection  Association’s  NFPA  101  Life  Safety  Code  is  required. 
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The  primary  goal  is  to  protect  human  life  from  fire  and  products  of 
combustion.  The  secondary  goals  are  to  reduce  Federal  Government  and 
taxpayers’  potential  losses  from  fire  (i.e.,  protect  Federal  real  and  personal 
property,  maintain  client  agency  mission  continuity,  and  control 
environmental  impact).  (2010a,  p.  235) 

Although  the  goals  describe  key  elements,  such  as  occupant  safety  and  the  need  to 
maintain  mission  continuity,  arson  related  fire  threats  are  not  mentioned.  In  fact,  the  word 
arson  does  not  appear  in  the  PI 00  standard. 

The  PI 00  standard  requires  that  all  projects  have  a  licensed  fire  protection 
engineer  on  the  architectural  design  team  to  conduct  an  overall  building  fire  safety 
analysis,  and  specifically  design  features,  such  as  the  means  of  egress,  fire  protection 
water  supply,  and  specialized  fire  protection  systems.  This  private-sector  fire  protection 
engineer  is  authorized  to  propose  deviations  from  the  prescriptive  PI 00  construction 
requirements,  and  these  must  be  submitted  for  approval  to  the  GSA  regional  fire 
protection  engineer  who  has  oversight  authority  on  fire  protection  and  life  safety  features 
of  the  project  (U.S.  General  Services  Administration,  2010a).  Alternative  designs  may 
include  a  perfonnance-based  approach  so  long  as  the  “proposed  alternative  is  deemed 
equivalent  of  superior  to  the  intent  of  the  prescribed  requirements”  (p.  236)  of  the  P100 
standard.  In  addition  to  the  general  fire  protection  design  requirements,  PI 00  references 
other  federal  standards  for  special  use  occupancies.  Table  3  summarizes  these  additional 
standards. 


Table  3.  Special  Federal  Fire  Protection  Design  Guides  based  on  Occupancy  (After: 

U.S.  General  Services  Administration,  2010a) 

_ Occupancy _ Design  Guide _ 

U.S.  Courts  P  100,  Chapter  9  and  the  U.S.  Courts  Design  Guide 


U.S.  Marshal  Service 

Land  Ports  of  Entry 
GSA  Child  Care  Centers 


USMS  Requirements  and  Specifications  for  Special 
Purpose  and  Support  Space,  Volumes  I,  II,  and  III 

Land  Port  of  Entry  Design  Guide 

GSA  Child  Care  Center  Design  Guide  (PBS-140) 
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The  2010  edition  of  PI 00  includes  references  to  the  ISC  Physical  Security 
Criteria  for  Federal  Facilities  and  adds  special  requirements  if  the  ISC  risk  management 
process  detennines  the  project  under  consideration  to  have  high  protection  risk  level  (see 
Figure  2).  In  those  instances,  P100  requires  that  the  project  design  team  conduct  a  fire 
protection  risk  assessment  of  the  building.  According  to  the  PI  00  standard: 

the  fire  protection  risk  assessment  is  a  technical  evaluation,  based  on 
professional  rationale  and  judgment,  of  potential  risks  involved  in 
achieving  desired  objective(s)  (e.g.,  protection  of  life,  the  property,  and 
the  mission).  It  involves  the  measurement  and  complete  documentation  of 
conditions  and  features  relevant  to  detennination  and  adjustment  of  the 
level  of  building  safety  and  the  adequacy  of  the  protection  provided.  The 
overall  combined  effect  of  all  positive  features  and  negative  conditions 
must  be  considered  in  the  evaluation  rather  than  the  effects  of  a  single 
item  or  concern.  The  result  will  be  a  logical  and  reliable  determination  of 
whether  equivalent  or  alternative  solutions  exist  for  any  or  all  negative 
conditions  caused  by  an  unwanted  event.  (U.S.  General  Services 
Administration,  2010a,  p.  257) 


C.  PRESCRIPTIVE  DESIGN  AND  CODES 

Despite  the  long-standing  application  of  prescriptive  designs  and  codes,  where  the 
architect  and  building  contractor  are  compelled  to  follow  a  prescribed  set  of  materials  and 
methods  to  satisfy  safety  requirements,  no  literature  evaluates  their  effectiveness.  Most  of 
the  research  that  exists  is  critical  of  prescriptive  designs  and  codes  in  that  they  lack 
suitable  safety  objectives,  stifle  innovation,  and  needlessly  increase  the  cost  of  building 
construction.  Hadjisophocleous,  Benichou,  and  Tamin  (1998)  reported  in  their  own 
literature  review  that  although  prescriptive  codes  proved  easy  to  verify  compliance  with 
the  regulations,  their  drawbacks  included  the  following. 

•  Specific  requirements  were  established  with  no  clear  objectives 

•  Cost-effective  designs  were  not  promoted 

•  Very  little  flexibility  existed  for  innovation  or  unusual  conditions 

•  A  presumption  that  there  was  only  a  single  design  solution  that  provided  a 
level  of  safety  (which  itself  was  not  defined) 

•  Challenges  applying  them  to  large,  complex  buildings 
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In  a  follow-up  article,  Hadjisophocleous  and  Benichou  (2000)  reiterated  their  earlier 
findings  that  prescriptive  codes  “have  the  advantage  that  designers  can  do  a  design  by 
just  following  prescriptions  and  that  code  officials  can  easily  detennine  whether  a  design 
follows  code  requirements”  (pp.  140-141),  but  the  impediments  to  innovation,  the  limited 
application  to  complex  designs,  and  the  lack  of  clearly  articulated  safety  objectives 
remained. 

Oster  and  Quigley  (1977)  were  critical  that  building  codes  acted  as  a  deterrent  to 
innovation  in  both  building  design  and  the  use  of  new  construction  materials  that  could 
increase  functionality  and  reduce  costs.  In  1981,  the  U.S.  Department  of  Housing  and 
Urban  Development  conducted  a  historical  survey  of  the  “Evolution  of  Building 
Regulations  in  the  United  States”  (Building  Technology,  1981).  The  report  found  that 
over  time,  building  codes  evolved  to  employ  three  primary  technical  requirements:  1) 
design  requirements  and  criteria  for  building  elements  and  systems  for  various 
occupancies,  2)  specifications  for  construction  materials,  and  3)  construction  details.  In 
all  cases,  these  requirements  were  prescriptive  in  their  nature. 

A  sample  of  building  code  officials,  who  generally  were  employees  of  local 
governments,  and  were  charged  with  the  interpretation,  application,  and  enforcement  of 
construction  codes,  were  polled  in  1996  to  research  their  willingness  to  accept 
perfonnance-based  designs,  which  then  were  a  relatively  new  concept  in  building 
construction.  Van  Rickley  (1996)  found  that  almost  80%  of  those  polled  agreed  with  the 
statement  “prescriptive  building  and  fire  codes,  as  they  currently  are  written,  are 
necessary  to  ensure  reasonable  levels  of  fire  protection  and  life  safety”  (p.  43).  In  a  study 
assessing  the  potential  economic  opportunities  for  wood  products  in  non-residential 
building  construction,  Goetzel  and  McKeever  (1999)  found  that  prescriptive  building 
codes  limited  the  structural  size  and  height  of  buildings,  especially  where  combustible 
construction  was  employed. 

Lord  and  Marrion  (2003)  studied  building  codes  in  six  developed  nations  and 
found  that  the  prescriptive  codes  did  not  always  provide  the  design  flexibility  or 
functional  needs  expressed  by  a  developer  or  tenant,  and  provided  only  a  limited  set  of 
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solutions.  Siu  (2005),  in  an  evaluation  of  three  historically  significant  high-rise  office 
fires,17  found  that  after  each  of  the  events,  “the  question  has  been  raised  whether 
prescriptive  building  codes  provide  adequate  protection  for  the  structure”  (p.  1).  Siu 
added  that  the  economic  and  societal  losses  of  the  three  buildings  also  proved  that 
prescriptive  building  codes  were  not  adequate  to  protect  buildings  from  fires.  Licht 
(2005)  argued  that  technical  changes  that  occurred  during  consolidation  of  the  three 
national  model  prescriptive  codes18  into  a  single  document  resulted  in  an  overall 
reduction  in  fire  and  life  safety,  and  especially,  put  fire  fighters  at  risk. 

In  projects  not  particularly  complex  or  requiring  unusual  design  features, 
prescriptive  codes  can  satisfy  basic  design  and  occupancy  needs.  Occasionally,  however, 
specific  circumstances  arise  that  do  not  fit  within  the  strict  confines  of  a  prescriptive 
code.  To  address  these  conditions,  the  legacy  and  current  model  construction  codes 
permit  the  designer  to  propose  the  use  of  alternate  methods  or  materials,  as  long  as  the 
resulting  construction  is  determined  to  be  equivalent  to  the  requirements  of  the 
prescriptive  code.  In  these  cases,  mixing  prescriptive  requirements  with  performance- 
based  designs  may  satisfy  both  the  code  official  and  the  pennit  applicant.  Mirkhah 
(1997b)  found  this  approach  to  provide  a  desirable  solution  to  a  complex  design  problem 
for  a  unique  high-rise  entertainment  structure  in  Las  Vegas.  Geren  (2004)  supported  this 
approach  as  a  means  of  providing  modem  building  designs  without  sacrificing  safety  or 
quality. 


17  The  fires  occurred  in  the  First  Interstate  Bank  in  Los  Angeles,  May  4,  1988,  One  Meridian  Plaza  in 
Philadelphia,  February  23,  1991,  and  New  York’s  World  Trade  Center  Building  7  on  September  11,  2001. 
The  outcome  of  these  fires  and  the  buildings’  performance  has  been  studied  extensively  among  fire 
protection  professionals. 

18  The  Building  Officials  and  Code  Administrators  International  National  Building  Code ,  the  Southern 
Building  Code  Congress  International  Southern  Standard  Building  Code,  and  the  International  Conference 
of  Building  Officials  Uniform  Building  Code  were  consolidated  in  2000  into  the  International  Building 
Code. 
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D.  PERFORMANCE-BASED  DESIGN 


Performance-based  fire  safe  building  design19  is  grounded  in  scientific  and 
engineering  principles  used  to  solve  fire  protection  and  life  safety  challenges. 
Consequently,  a  substantial  portion  of  the  literature  addresses  results  from  empirical  fire 
research  and  human  behavior  studies.  Less  contemporaneous  writing  on  the  policy 
implications  of  perfonnance-based  design  is  occurring,  and  a  growing  body  of  opinion  on 
its  merits  is  appearing.  In  Europe  and  Pacific  Asia,  where  performance-based  design  has 
been  established  since  the  mid  1980s,  the  policy  literature  is  richer.  Also,  a  group  of 
professionals  are  wary  of  performance-based  fire  safe  building  design,  and  argue  that 
longstanding  consensus-based  prescriptive  methods  better  serve  fire  safety  needs  because 
of  their  built-in  redundancies  that  have  accumulated  from  collective  fire  experiences.  The 
modeling  documentation  often  used  in  perfonnance-based  design  is  not  yet  developed 
enough  to  be  reliable. 

Perfonnance-based  fire  safe  design  advocacy  started  in  the  United  States  in  the 
mid-1960s.  Watts,  Jr.  (1966)  argued  for  a  fire  safety  objectives  approach  in  an  editorial  in 
Fire  Technology,  the  quarterly  scientific  and  engineering  research  journal  published  by 
the  National  Fire  Protection  Association.  He  suggested  that  scientists  and  engineers 
needed  to  move  from  vague  statements  to  a  precise  and  specific  measure  of  perfonnance. 

In  the  United  States,  the  seminal  literature  for  perfonnance-based  design  was  a 
report  prepared  by  the  U.S.  General  Services  Administration  (GSA)  in  1972  entitled 
Building  Fire  Safety  Criteria,  Appendix  D:  Interim  Guide  for  Goal-Oriented  Systems 
Approach  to  Building  Firesafety.20  The  report  was  the  result  of  a  GSA  conference  in 
1971,  an  International  Conference  on  Fire  Safety  in  High-Rise  Buildings  (Meacham, 
1998c).  The  document  provided  a  groundbreaking  new  approach  to  building  design  by 
“demonstrating  that  engineers  can  view  the  building  and  fire  as  integral  components  of  a 


19  For  simplification,  the  term  performance-based  design  is  used  throughout  this  text  as  a  general  term 
that  encompasses  performance-based,  objective-based,  and  functional  design  (Meacham,  1998a). 

In  the  fire  protection  field,  spelling  “fire  safety”  as  a  single  word,  “firesafety,”  is  a  commonly 
accepted  practice. 
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single  system,  and  that  [the  traditional  method  of]  evaluating  or  designing  individual 
components  without  regard  to  the  system,  potentially  severe  shortcomings  in  the  design 
could  result”  (Meacham,  1998a,  p.  4). 

As  a  proof  of  concept  that  could  be  applied  to  a  GSA  project  then  under 
development,  engineers  borrowed  an  event  logic  diagram  that  became  known  as  the  fire 
safety  concepts  tree.  The  diagram  was  founded  in  the  system  safety  analysis  and  fault  tree 
analysis  process  developed  by  the  National  Aeronautics  and  Space  Administration  to 
enhance  reliability  in  the  nascent  space  program.  This  logic-based  decision-making  tool 
eventually  became  the  National  Fire  Protection  Association  (NFPA)  NFPA  550,  Guide  to 
the  Fire  Safety  Concepts  Tree  (National  Fire  Protection  Association,  1995).  Starting  with 
the  goal  of  “prevent  fire  ignition,”  the  fire  safety  concepts  tree  plotted  fire  safety  design 
objectives  through  a  series  of  “OR  gates”  that  gave  designers  alternatives  to  choose  one 
solution  or  another. 

The  U.S.  Department  of  Commerce  National  Bureau  of  Standards  followed  the 
GSA  interim  guide  in  197921  and  the  U.S.  Department  of  Health,  Education  and  Welfare 
study  A  Theoretical  Rationalization  of  a  Goal-Oriented  Systems  Approach  to  Building 
Fire  Safety  (Watts  Jr.,  1979).  This  report  articulated  the  concepts  of  deterministic  and 
probabilistic  approaches  to  fire  safe  design  as  alternatives  to  traditional  prescriptive 
compliance.  The  detenninistic  approach  “presumes  an  ability  to  determine  the  precise 
behavior  of  any  fire  at  any  time  in  the  future,  given  exact  contemporary  conditions  and 
the  antecedent  state  of  the  building  and  its  contents”  (Watts  Jr.,  1979,  p.  7).  At  this  time, 
Watts  Jr.  acknowledged  not  enough  scientific  data  existed  to  employ  this  method. 

On  the  other  hand,  the  goal-oriented  or  probabilistic  approach  derived  in  the  GSA 
Appendix  D,  reasoned  that  a  certain  amount  of  hazard  was  unavoidable  and  that  “a  fire 
safety  goal,  such  as  maintaining  the  continuity  of  an  organizational  mission,  could  be 
expressed  in  terms  of  a  probability  of  limiting  fire  extent”  (Watts  Jr.,  1979,  p.  9). 


The  National  Bureau  of  Standards  is  now  the  National  Institute  of  Science  and  Technology. 
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Beck  (as  cited  in  Meacham,  1998a)  conducted  research  in  Australia  to  develop  a 
building  fire  safety  model  that  estimated  the  level  of  risk  for  the  particular  building  being 
modeled.  The  model  was  based  on  the  probability  of  events  occurring  at  a  specific  time 
related  to  the  time  of  fire  ignition.  The  model  used  five  sub-systems  (nature  of 
occupancy,  fire  growth  and  development,  smoke  management,  flame  management,  and 
occupant  avoidance  and  fire  fighting)  to  identify  consequences  in  terms  of  the  number  of 
people  exposed  to  dangerous  conditions  (Meacham,  1998a). 

The  next  significant  development  in  the  literature  was  Fitzgerald’s  Building 
Firesafety  Evaluation  Method  created  in  1985  (as  cited  in  Meacham,  1998a).  Unlike  the 
fire  safety  concepts  tree,  Fitzgerald’s  approach  was  to  work  inversely  from  a  likely 
ignition  scenario  and,  using  network  diagrams,  evaluated  factors,  such  as  ignition 
potential,  fire  growth  potential  within,  and  from  a  compartment,22  and  occupant  safety. 
Within  the  network,  at  any  point,  an  experienced  user  could  apply  subjective 
probabilities — or  statistical  data — to  estimate  the  likelihood  of  each  event  occurring  with 
an  anticipated  outcome  that  was  the  likelihood  of  whether  any  event  will  or  will  not  occur 
(Meacham,  1998a). 

In  the  1980s,  a  substantial  portion  of  the  literature  focused  on  empirical  fire  and 
human  behavior  studies  (see  next  section).  During  this  time,  several  countries,  including 
the  United  Kingdom  (UK),  Japan,  Australia,  and  New  Zealand,  rewrote  their  national 
building  regulations  to  de-emphasize  prescriptive  requirements,  and  encourage 
performance-based  solutions. 

By  1998,  although  much  of  the  rest  of  the  developed  world  embraced 
perfonnance-based  designs,  in  Assessment  of  the  Technological  Requirements  for  the 
Realization  of  Performance-Based  Fire  Safety  Design  in  the  United  States — Phase  1 : 
Fundamental  Requirements,  Meacham  found  that  the  United  States  was  still  reluctant  to 
do  so  because  of  the  lack  of  documentation  and  credibility  of  the  state  of  engineering 


22  In  the  fire  protection  field,  a  compartment  generally  describes  a  space  having  boundaries  of  at  least 
a  floor,  walls,  and  ceiling.  The  size,  shape,  slope,  materials,  and  dimensions  of  each  plane  are  immaterial  at 
this  level  of  definition. 


26 


tools  and  methodologies  for  fire  safe  building  design  (Meacham,  1998a).  The  Society  of 
Fire  Protection  Engineers  and  National  Fire  Protection  Association  in  2000  took  a  major 
step  toward  resolving  the  documentation  and  protocol  issues  by  publishing  The  SFPE 
Engineering  Guide  to  Performance-Based  Fire  Protection  Analysis  and  Design  of 
Buildings.  This  workbook  provided  a  step-by-step  method  to  identify  and  document  the 
design  parameters  employed  in  performance-based  projects  (National  Fire  Protection 
Association  &  Society  of  Fire  Protection  Engineers,  2000). 

In  “Accommodating  Perceptions  of  Risk  in  Performance-Based  Building  Fire 
Safety  Code  Development,”  Wolski,  Dembsey,  and  Meacham  (2000)  introduced  the  two 
methods  of  adding  risk  factors  to  buildings,  and  categorized  them  as  low,  medium,  or 
high  risks.  In  the  first  method,  risk  adjustment  factors  could  be  adjusted  during  the 
detenninistic  analysis  of  the  building  design  to  assess  if  additional  fire  safety  features 
would  be  needed.  The  second  method  would  be  applied  during  the  probabilistic  approach 
to  develop  risk  conversion  factors  related  to  expected-risk-to-life  values  so  design 
adjustments  could  be  made  dependent  upon  the  perceived  fire  safety  risk  to  occupants. 

Bukowski  (2006)  provided  a  post-September  11,  2001  assessment  in  Determining 
Design  Fires  for  Design-Level  and  Extreme  Events.  The  jet  fuel-fed  fires  that  destroyed 
the  World  Trade  Center  north  and  south  towers  exceeded  the  commonly  anticipated  scale 
of  performance-based  designs  for  past  and  current  high-rise  office  buildings. 

More  recently,  a  federal  interagency  working  group  consisting  of  representatives 
from  DHS,  Department  of  Justice,  U.S.  Nuclear  Regulatory  Commission,  the  GSA,  and 
Administrative  Office  of  the  U.S.  Courts,  published  a  design  standard  entitled  Physical 
Security  Criteria  for  Federal  Facilities:  An  Interagency  Security  Committee  Standard 
(U.S.  Department  of  Homeland  Security,  2010c).  The  standard  strongly  emphasizes  the 
importance  of  a  facility  security  committee  that  identifies  threats,  vulnerabilities,  and 
countenneasures  as  part  of  a  risk-based  decision  process  for  design,  which  is  a  significant 
step  toward  a  performance-based  fire  safe  design  in  federal  facilities. 

When  stakeholders  and  the  design  team  establish  a  project’s  fire  safety  objectives, 

a  critical  point  of  agreement  must  occur  regarding  the  nature  of  what  are  called  design 
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fire  scenarios.  These  scenarios  generally  include  the  range  of  fire  challenges  that  could  or 
likely  would  occur  in  a  given  building  or  facility  based  on  the  nature  of  its  use,  contents, 
and  even  threats.  It  is  the  variety  of  scripted  fire  scenarios  against  which  the  design  team 
must  show  its  proposed  solutions  will  mitigate  or  control  the  event  as  a  measure  of 
success,  which  is  one  of  the  shortcomings  of  the  Physical  Security  Criteria  for  Federal 
Facilities:  An  Interagency  Security  Committee  Standard.  Without  a  clearly  articulated 
arson  fire  scenario,  rational  countermeasures  to  address  the  threat  or  reduce 
vulnerabilities  cannot  be  developed  and  prescriptive  solutions  may  not  be  satisfactory. 
Zalok  and  Hadjisophcleous  (2009)  found  that  “the  development  of  a  design  fire  scenario 
is  a  combination  of  hazard  analysis  and  risk  analysis.  Hazard  analysis  identifies  potential 
hazards,  such  as  ignition  sources,  fuels,  and  fire  development.  Risk  analysis  includes  the 
indicated  hazard  analysis  and  the  likelihood  of  occurrence  (either  quantitatively  or 
qualitatively),  and  the  severity  of  the  outcomes”  (Zalok  &  Hadjisophocleous,  2009,  p. 
1082). 

According  to  the  SFPE  (National  Fire  Protection  Association  &  Society  of  Fire 
Protection  Engineers,  2000),  each  scenario  should  define  three  components:  fire 
characteristics,  building  characteristics,  and  occupant  characteristics.  Fire  characteristics 
include  the  anticipated  range  of  possible  fire  scenarios  from  an  unintentional  error  to  an 
arson  attack.  The  potential  rate  of  fire  growth,  its  expected  time  to  flashover,  and  when  it 
may  be  extinguished,  must  be  considered.  Building  characteristics  include  architectural 
features,  such  as  large  open  spaces  or  small  compartments,  structural  components  and 
building  materials,  fire  protection  systems  and  equipment,  building  services  (e.g., 
heating,  air  condition,  elevators  and  escalators),  and  fire  department  response  capabilities. 
Occupant  characteristics  include  the  potential  number  of  occupants,  their  distribution 
through  the  building,  alertness,  mobility,  and  physical  or  psychological  conditions. 

As  part  of  its  PI 00  “Facilities  Standards  for  the  Public  Buildings  Service,”  the 
GSA  adopted  the  national  consensus  standard  NFPA  101,  “Life  Safety  Code.”  The 
standard  includes  eight  design  fire  scenarios  that  must  be  used  if  an  architect  or  engineer 
elects  to  use  a  performance-based  design  approach  in  lieu  of  a  prescriptive  method.  Table 
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16  summarizes  the  elements  of  the  eight  design  scenarios.  Yung  and  Benichou  (2002) 
offered  a  sample  of  six  different  design  fire  scenarios  based  on  the  nature  of  the  fire 
(smoldering,  flaming  or  flashover)  and  whether  the  entrance  door  to  the  room  in  which 
the  design  fire  occurred  was  open  or  closed.  They  also  acknowledged  that  the  prediction 
of  fire  growth  in  a  room — before  it  happens — was  difficult  due  to  the  almost  limitless 
number  of  configurations  of  the  type,  quantity,  and  arrangement  of  combustible  contents, 
as  well  as  where  those  combustibles  might  be  ignited: 

The  proposed  design  fires  depend  only  on  parameters  that  can  be 
characterized  a  priori ,23  such  as  occupancy  type,  amount  of  combustibles, 
size  of  the  compartment,  and  the  ventilation  conditions.  Random 
parameters,  such  as  the  arrangement  of  the  combustibles  and  the  point  of 
ignition,  are  taken  into  consideration  by  using  statistical  infonnation  on 
probabilities  of  fire  types.  (Yung  &  Benichou,  2002,  p.  232) 

This  statement  on  the  need  to  evaluate  random  parameters  is  important  in  the  assessment 
of  protecting  federal  facilities.  Although  Yung  and  Benichou  emphasized  the  need  for 
statistical  sampling  on  fire  types,  they  did  not  mention  significant  statistical  anomalies, 
such  as  the  World  Trade  Center  attacks  of  September  11,  2001.  This  shortcoming  may  be 
due  to  the  fact  their  research  was  presented  in  2000, 24  and  published  only  two  years  later. 

In  a  2003  report  commissioned  by  the  National  Science  Foundation,  (Lucht  et  ah, 
2003)  found  that  current  performance-based  design  and  building  practices  offered  “real 
promise  for  regulators  and  public  officials  to  institute  regulations  that  reflect  a  better 
understanding  of  risks  and  improved  safety  perfonnance  for  buildings  in  their 
communities”  (p.  3). 

Thompson  and  Bank  (2007)  compared  existing  perfonnance  based  design 
practices  and  standards  for  seismic  protection  and  fire  safety,  and  detennined  an 
opportunity  does  exist  to  use  performance  based  design  protocols  for  temorism  resistant 
buildings.  They  claimed  the  first  step  toward  acceptance  of  this  method  would  be  the 
ability  to  characterize  the  types  of  terrorism-related  hazards  facing  building  designers  and 

22  In  this  context,  “before  the  event.” 

24  Yung  and  Benichou’s  paper  originally  was  presented  at  the  5th  Fire  Risk  and  Hazard  Assessment 
Research  Application  Symposium  in  Atlantic  City,  New  Jersey,  June  28-30,  2000. 
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criteria  for  acceptable  levels  of  risk.  Thompson  and  Rank  reported,  “to  be  truly  effective 
at  improving  the  safety  of  building  occupants,  a  methodology  must  address  the  full  range 
of  terrorism-related  threats,  including  not  only  traditional  blast  attacks,  but  chemical  and 
biological  agent  attacks,  and  attacks  on  any  system  in  the  building”  (p.  66). 

Bwalya  (2009)  reported  that  the  choice  of  design  fires  must  be  influenced  by  the 
nature  of  the  fire  safety  assessment  or  design  tasks  being  undertaken.  While  the  routine 
concerns  about  the  type  and  nature  of  combustibles,  ignition  method,  fire  growth,  and  fire 
decay  were  important,  “there  is  a  requirement  for  the  design  fire  to  represent  a  fire  that 
presents  a  formidable  challenge  to  whichever  fire  safety  feature  or  aspect  of  a  building  is 
being  evaluated”  (p.  181). 

E.  COMPUTERIZED  FIRE  MODELS  AND  VALIDITY 

In  developing  and  evaluating  the  safety  objectives  in  perfonnance-based  designs, 
it  is  not  feasible  to  build  a  full-size  version  of  the  building  or  facility  under  study  and  set 
it  on  fire  to  observe  the  outcome.  Consequently,  computerized  fire  effects  models  often 
are  used  to  test  hypotheses  and  assess  the  potential  outcome  of  design  fires.  It  is 
important  to  note  that  fire  effects  models  are  not  predictive,  but  are  representative  of  data 
collected  from  full-  and  small-scale  fire  tests  and  post-incident  analysis  of  real  world 
events.  Can  fire  modeling  results  be  considered  valid  for  their  applicability  to  building 
and  facility  design  where  human  lives  are  at  stake  and  property  must  be  protected  from  a 
variety  of  threats?  In  the  fire  protection  context,  validity  is  a  measure  of  the  model’s 
ability  to  replicate  real  world  fire  events.  Models  continue  to  improve  as  they  are 
compared  to  experimental  (live)  fires  and  data  sets  become  richer  in  the  scientific  and 
research  literature. 

Fire  effects  models  are  divided  into  four  major  categories  that  simulate  the  fire 
environment:  zone,  field,  large  eddy  simulation,  and  direct  numerical  simulation  models 
(Gissi,  2010).  All  use  complex  mathematical  fonnulas  to  quantify  the  physical 
characteristics  of  the  fire  environment.  Zone  models  typically  are  one-  or  two- 
dimensional,  and  operate  on  the  assumption  that  the  space  where  the  fire  is  being 
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modeled — generally  called  a  compartment — is  divided  into  two  realms:  an  upper  zone  of 
hot  fire  products  of  a  relatively  unifonn  temperature  and  composition,  and  a  cooler  lower 
zone  containing  some  amount  of  contaminants.  Field  models  divide  the  compartment 
being  studied  into  three-dimensional  cells  (the  size  of  which  can  be  adjusted)  and  the 
calculations  describe  the  physical  interaction  between  and  among  cells  that  thus  enable  a 
more  detailed  assessment  of  the  fire  environment.  Zone  models  tend  to  be  less 
sophisticated  and  require  less  computing  capacity.  Field  models  are  more  complex  and 
require  powerful  computers. 

Large  eddy  simulations  attempt  to  capture  accurate  relationships  between  the 
turbulent  mixing  of  gases  and  combustion  products  within  the  immediate  area  around  the 
fire  (Gissi,  2010).  They  require  smaller  computational  grids  and  substantial  computing 
power  and  speed.  Direct  numerical  simulation  performs  complex  equations  without  any 
discrete  space  or  time  considerations  for  turbulence,  which  means  the  entire  fire 
environment  is  modeled  simultaneously.  According  to  Gissi  (2010),  direct  numerical 
simulation  is  the  most  sophisticated  means  of  fire  simulation,  and  consequently,  exceeds 
the  capacity  of  the  most  powerful  computers  available  today. 

Other  computer  models  employed  in  fire  protection  analysis  include  tools  that 
simulate  the  response  time  of  fire  detection  devices,  such  as  heat  detectors  or  automatic 
sprinklers,  egress  models  that  evaluate  human  movement  in  buildings  to  assess 
evacuation  perfonnance,  fire  endurance  models  to  evaluate  how  various  building 
components  react  to  fire  exposure,  and  models  that  address  detailed  topics,  such  as  glass 
breakage,  smoke  movement,  or  flame  spread. 

Attempts  to  model  complex  fire  behavior  began  in  the  late  1950s  when  Japanese 
researcher  Kawagoe  studied  the  relationships  between  temperature  and  ventilation  on  the 
outcome  of  room  fires  (Kawagoe,  1958).  Subsequently,  a  number  of  researchers  began  to 
develop  hand-calculated  mathematical  formulas  to  explain  fire  behavior  that  they  studied. 
The  expansion  of  the  electronic  computer  in  conjunction  with  the  growing  international 
study  of  fire  behavior  has  made  fire  modeling  a  preferred  tool  in  the  evaluation  of 
performance-based  designs.  By  1992,  one  survey  of  the  contemporary  state  of  fire 
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modeling  found  74  models  from  13  countries  were  then  in  use  (Friedman,  1992).  The 
understanding  of  fire  behavior  and  the  ability  to  replicate  it  in  computerized  fire  models 
has  progressed  dramatically  in  the  last  20  years. 

Friedman  (1992)  found  that  models  he  surveyed  might  not  compare  to  actual  fire 
behavior  for  any  of  the  five  following  reasons. 

•  Idealizations  and  simplifications  on  which  the  model  was  based  might 
deviate  significantly  from  real  world  conditions 

•  Input  parameters  (data  entry)  supplied  to  the  model  were  inaccurate 

•  Defaults  values  of  the  coefficients  in  the  underlying  computational 
routines  were  flawed 

•  The  computational  process  itself  yielded  incorrect  results  due  to  time  and 
scaling  problems  in  the  mathematical  equations 

•  The  experiments  themselves  were  not  correct  or  could  not  be  repeated 

In  1996,  Babrauskas  reported  that  contemporary  fire  models  were  unable  to 
reproduce  even  the  most  fundamental  characteristics  of  fire  behavior.  Babrauskas’s 
survey  (1996)  found  that  modeling  software  in  use  at  the  time  was  unable  to  reproduce 
flame  spread,  heat  release  rate,  fire  or  smoke  chemistry  (especially  the  production  of 
carbon  monoxide),  a  realistic  mixing  of  heated  gas  layers  within  a  compartment,  or  the 
influence  of  fire  suppression. 

To  provide  professional  design  guidance,  in  1997,  ASTM  International  (ASTM)25 
published  two  documents:  Standard  Guide  for  Determining  the  Uses  and  Limitations  of 
Deterministic  Fire  Models  (ASTM  El 895)  and  Standard  Guide  for  Evaluating  the 
Predictive  Capability  of  Fire  Models  (ASTM  E1355).  The  first  provided  guidance  for 
users  and  code  officials  in  establishing  the  appropriate  uses  and  limitations  of  fire  models 
in  fire  risk  and  hazard  assessments  (ASTM  International,  2007).  The  second,  ASTM 
El 355,  provided  methods  for  evaluating  models  by  comparing  their  analytical  precision 
to  standard  fire  tests,  full-scale  fire  experiments,  field  experience,  published  literature,  or 
previously  evaluated  models  (ASTM  International,  2011). 

Formerly  the  American  Society  for  Testing  and  Materials.  It  is  a  non-profit  organization  for 
developing,  delivering,  and  coordinating  voluntary  consensus  standards. 
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In  2002,  16  researchers  from  10  countries  conducted  a  round  robin  modeling 
exercise  to  compare  their  results  from  a  single  fire  scenario.  The  purpose  of  the  round 
robin  was  to  detennine  if  modelers  could  obtain  similar  results  from  the  same  inputs,  and 
thereby,  validate  the  models’  reliability  to  portray  real  world  events.  The  design  fire 
consisted  of  a  single  room  with  a  wooden  material  fire  source.  The  participants  used  two 
field  models  and  nine  two-zone  models  in  their  assessments.  After  comparing  fire  model 
outputs  to  live  experimental  fires,  Keski-Rahkonen  and  Hostikka  (2002)  found  deviations 
between  the  modeled  results  and  the  live  fire  data,  principally  because  the  types  of  fires 
were  not  well  suited  for  the  zone  models.  They  also  found  discrepancies  in  the  results 
ranging  from  ±  10%  up  to  a  factor  of  two,  which  were  in  the  same  range  of  uncertainty  as 
the  experimental  data.  However,  the  differences  were  attributed  not  to  the  models,  but  to 
the  skills  of  those  performing  the  data  input. 

By  2003,  Olenick  and  Carpenter  found  the  number  of  fire  models  had  grown  to 
almost  140,  and  that  computer  modeling  of  fire  and  smoke  transport  was  becoming  a 
more  accepted  practice  because  of  improvements  both  in  knowledge  about  fire  behavior 
and  improved  computer  perfonnance.  Olenick  and  Carpenter  (2003)  reported  that  since 
Friedman’s  survey,  “increased  use  of  modeling  is  also  attributable  to  the  move  towards 
performance-based  building  codes  in  the  United  States  and  other  countries.  Instead  of 
using  a  prescriptive  building  code,  engineers  now  can  design  for  egress  of  building 
occupants  under  varying  fire  conditions”  (Olenick  &  Carpenter,  2003,  p.  88). 

Salley  et  al.  (2007)  assessed  the  accuracy  of  fire  model  results  and  found  that  for 
some  study  areas,  zone  models  were  adequate  (e.g.,  ceiling  temperatures  and  flame 
heights),  and  the  more  sophisticated  field  models  were  better  suited  for  some  analysis 
(e.g.,  predicting  heat  flux  and  fire  behavior  in  asymmetrical  compartments).  However,  for 
complex  fire  scenarios,  design  engineers  should  employ  field  modeling  because  the 
results  are  likely  to  be  more  reliable. 

Beard  (2008)  expressed  apprehension  that  an  inexperienced  user  may  interpret  the 
fact  that  a  model  has  been  validated  means  it  somehow  will  accurately  predict  real  world 
conditions.  This  perception  is  a  legitimate  concern  of  many  fire  protection  professionals 
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who  fear  that  an  inexperienced  or  disingenuous  modeler  may  use  the  technique 
inappropriately.  According  to  Beard  (2008),  different  users  of  a  model  may  produce  very 
different  results  based  on  inputs  and  variable  controls.  The  next  year,  Beard  cited  the 
following  potential  error  sources  in  modeling. 

•  Inputting  data  presented  as  a  realistic  depiction  of  real  world  events 
without  acknowledging  that  the  conceptual  and  numerical  assumptions  in 
a  model  were  only  an  approximation  of  actual  fire  behavior 

•  Failing  to  follow  the  strict  protocols  for  the  model  being  used  that 
potentially  could  result  in  both  mathematical  miscalculations  and  errors  in 
scale 

•  Fundamental  computational  errors  in  the  software.  Beard  claimed  one 
estimate  suggested  as  many  as  eight  possible  errors  for  each  1,000  lines  of 
computer  source  code 

•  Faults  in  computer  hardware  that  might  be  the  result  of  a  flawed  micro¬ 
processor  design,  manufacture,  or  a  combination  of  both 

•  Errors  entering  data  or  interpreting  the  results 

•  Inadequate  documentation  that  implies  the  model  selected  is  appropriate 
for  the  scenario  being  represented  when  it  may  not  be  the  best  available 
tool  (Beard,  2009) 

In  their  assessment  of  one  of  a  series  of  highly  instrumented  and  documented 
apartment  fire  tests  in  Dalmamock,  Scotland,  Rein,  Jahn,  and  Torero  (2011)  found  that 
fire  simulations  conducted  before  the  live  fires  (a  priori)  dramatically  overpredicted 
temperatures  of  hot  gas  layers  and  surfaces  by  20  to  800  percent.  A  posteriori  modeling 
reduced  the  error  range  to  10-200  percent.  They  concluded  the  following. 

•  Even  in  a  posteriori  simulations  (with  full  access  to  the  measurements)  it 
is  not  easy  to  reproduce  the  fire 

•  The  incapability  of  predicting  fire  growth  is  shown  to  be  a  fundamental 
constraint  to  fire  modelling  [sic] 

•  When  the  HRR  [hear  release  rate]  is  unknown  as  it  is  in  most  practical 
cases,  the  use  of  lower  and  upper  HRR  bounds  should  be  included  as  to 
reflect  in  the  predictions  the  effect  of  uncertainty  in  the  HRR.  This  is  an 
important  issue  for  the  application  of  fire  modelling  [sic]  to  real  scenarios 
when  the  HRR  us  unknown  (i.e.,  [sic],  forensic  investigation  and  assumed 
design  scenarios),  (p.  10) 
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Jahn,  Rein,  and  Torero  (2008)  reported  that  fire -modeling  tools  provide  good 
predictions  of  the  thermal  consequences  of  a  fire,  but  their  ability  to  predict  fire 
development  and  HRR  is  problematic;  therefore,  it  is  incumbent  on  the  modeler  to 
specify  the  HRR  input  variable.  In  a  recent  study,  Zalok  and  Hadjisophocleous  (2009) 
attempted  to  create  virtual  fuel  load  configurations  in  seven  different  commercial-type 
buildings.  The  purpose  was  to  develop  data  inputs  based  on  fuel  load  surveys  that  could 
be  inputted  into  a  fire  effects  model,26  and  thereby,  reduce  the  need  to  conduct  detailed 
surveys  or  conduct  full-scale  fire  tests.  They  found  that  “although  models  might  not 
always  give  accurate  predictions,  the  results  of  validated  models  can  be  used  with 
confidence  in  the  design  of  fire  protection  systems”  (p.  20).  Their  research  showed  that 
the  difference  between  predicted  peak  HRR  and  the  experimental  peak  HRR  was  less 
than  16%,  “giving  confidence  in  the  model  for  use  in  predicting  more  complicated  cases” 
(2009,  p.  20). 

F.  FIRE  AND  BEHAVIOR  STUDIES 

Empirical  fire  research  and  human  behavior  studies  for  performance-based  fire 
safe  building  design  are  intended  to  quantify  the  interaction  among  fire  ignition,  product 
or  material  combustibility,  fire  and  smoke  behavior,  building  structural  and  fire  resistance 
features,  fire  protection  systems  and  human  behavior,  such  as  relocation,  shelter-in-place, 
or  evacuation.  These  studies  have  helped  designers  better  understand  the  role  of  these 
elements  in  a  single  system.  While  these  studies  add  substance  to  the  engineering 
applications  of  performance-based  designs,  they  are  outside  the  scope  of  this  thesis, 
which  is  focused  on  policy  implications  of  performance-based  fire  safe  building  designs. 

Titles,  such  as  Natural  Smoke  Filling  in  Atrium  with  Liquid  Pool  Fires  Up  to  1.6 
MW  (Chow,  Li,  &  Huo,  2001),  A  Computational  and  Experimental  Study  of  Fire  Growth 
and  Smoke  Movement  in  Large  Spaces  (Kashef,  Benichou,  Lougheed,  &  Mccartney, 
2002),  Experimental  Fire  Tower  Studies  of  Elevator  Pressurization  Systems  for  Smoke 
Control  (Tamura  &  Klote,  1987),  Characterization  of  Fire  Induced  Flow  Transport 

26  In  this  study,  they  evaluated  a  field  model.  Fire  Dynamics  Simulator. 
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Along  Ceilings  Using  salt- Water  Modeling  (Yao,  2006),  and  A  Performance  Based 
Methodology  Using  Travelling  Fires  for  Structural  Analysis  (Spence,  2000),  illustrate  the 
scope  and  scale  of  empirical  fire  behavior  studies.  Many  of  the  studies  focused  on  a 
single  fire  behavior  or  the  performance  of  a  single  building  component  when  exposed  to 
controlled  fires  in  a  laboratory. 

Magnusson,  Frantzich,  and  Harada  (1996)  in  “Fire  Safety  Design  Based  on 
Calculations:  Uncertainty  Analysis  and  Safety  Verification”  described  results  from 
occupant  evacuation  studies  conducted  in  a  one-room  public  assembly  building  using  a 
number  of  uncertainty  analysis  procedures  including  the  analytical  first-order  second- 
moment  (FOSM)  method,  two  numerical  random  sampling  procedures  (simple  random 
sampling  and  Latin  hypercube  sampling),  and  standard  probabilistic  risk  analysis 
methods.  Their  work  was  just  one  of  several  that  studied  human  behavior  in  fires  that 
reviewed  both  reaction  and  response  times  to  queuing  and  evacuation  actions. 

G.  GLOBAL  EXPERIENCE  WITH  PERFORMANCE-BASED  DESIGN  AND 

CODES 

In  Europe  and  Pacific  Asia,  perfonnance-based  fire  safe  designs  have  been 
employed  for  more  than  two  decades.  These  designs  have  provided  the  designers  and 
regulatory  authorities  an  opportunity  to  assess  the  success  or  failure  of  this  design  option. 

In  Hong  Kong,  Walters,  and  Hastings  (1998)  studied  14  years  of  disastrous 
multiple-death  fires  in  that  colony,  and  found  that  in  addition  to  cultural  complacency,  a 
weak  and  outdated  regulatory  environment  correlated  to  the  significant  losses.  They 
noted  in  Fire  Safety  Legislation  in  Hong  Kong,  for  the  latest  fire  codes  of  practice  that 
are  applicable  to  new  work,  “the  Government  has  started  to  include  perfonnance-based 
criteria  as  an  ‘alternative  approach  to  fire  engineering.’  The  use  of  perfonnance  codes 
requires  legislators  and  policy  makers  to  be  explicit  in  their  objectives  and  standards  of 
public  welfare  and  safety”  (p.  253).  New  Zealand  has  substantial  experience  with 
perfonnance-based  fire  safe  building  design.  Buchanan  produced  a  small  study  from  nine 
city  councils  around  the  country  entitled  “Implementation  of  Perfonnance-Based  Fire 
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Codes.”  The  results  showed  survey  participants  believed  the  new  codes  resulted  in  a 
major  increase  in  perceived  safety  for  building  occupants,  but  a  significant  decrease  in 
property  protection  (Buchanan,  1999). 

On  the  other  hand,  Buchanan,  Deam,  Fragiacomo,  Gibson,  and  Morris  (2006) 
found  that  performance-based  design  has  increased  architectural  flexibility  and  reduced 
construction  costs,  but  also  resulted  in  some  problems  including  different  levels  of 
enforcement  across  the  country,  and  poor  workmanship,  especially  where  local  building 
inspections  have  been  insufficient  to  ensure  the  expected  quality  of  design  or  on-site 
workmanship  from  the  small  number  of  poorly  qualified  designers  or  sloppy  builders 
who  cause  problems.  Buchanan  et  al.  findings  were  corroborated  by  additional  research 
in  “Performance-Based  Regulation  and  Regulatory  Regimes:  The  Saga  of  Leaky 
Buildings”  (May,  2003).  Consequently,  New  Zealand  has  had  to  adopt  stricter  building 
code  regulations.  One  study,  New  Zealand  Fire  Service  Design  Review  Audit,  identified 
poor  submittal  documentation  as  a  problem  for  regulatory  officials  (I.  Thomas,  2006). 
New  Zealand  recently  modernized  its  fire  safety  approach  in  building  codes  with  the 
creation  of  “Verification  Method:  Framework  for  Fire  Safety  Design”  (New  Zealand 
Ministry  of  Business,  Innovation  and  Employment,  2012)  that  requires  a  chartered 
professional  engineer  to  satisfy  10  design  fire  scenarios  with  detailed  consideration  given 
to  six  parameters:  fire  growth  rate,  peak  heat  release  rate,  fire  load  energy  density,  gas 
species  production  (carbon  monoxide,  carbon  dioxide,  water  and  soot),  heat  flux,  and 
time.  The  new  regulations  are  intended  to  require  a  greater  level  of  detail  in  fire  modeling 
data  inputs  to  achieve  a  more  robust  analysis  of  the  outputs. 

Canadian  researchers  Hadjisophocleous  and  Benichou  (1999)  found  that 
perfonnance-based  design  strategies  often  were  used  to  satisfy  alternative  material  and 
method  solutions  for  satisfying  rigid  prescriptive  building  code  requirements.  In  South 
America,  Tavares  (2009)  began  studying  Brazilian  cultural  acceptance  of  perfonnance- 
based  designs  in  his  work  “An  Analysis  of  the  Fire  Safety  Codes  in  Brazil:  Is  the 
Perfonnance-Based  Approach  the  Best  Practice?” 
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Swedish  authors,  Cronsioe,  Stromgren,  Tonegran,  and  Bjelland  (2012),  reported 
that  too  much  freedom  in  the  application  of  performance-based  design  might  increase  the 
uncertainty  in  levels  of  fire  safety.  They  advocate  a  more  consistent  transnational 
approach  (especially  in  Europe)  to  identify  appropriate  fire  safety  objectives  while 
accounting  for  differences  among  legal  frameworks,  practitioner  skills,  and  code 
officials. 

H.  POLICY  CONSIDERATIONS 

The  goal  of  performance-based  design  is  to  make  architectural  decisions  on  well- 
articulated  scientific  and  engineering  principles  while  encouraging  design  freedom, 
reducing  costs,  and  minimizing  construction  redundancies  that  have  evolved  in  the 
prescriptive  methods.  For  years,  owners,  architects,  and  builders  have  been  constrained 
by  the  obligation  to  “meet  the  code,”  often  without  a  logical  or  contemporary  nexus  to 
fire  behavior  or  occupant  safety.  The  potential  change  from  prescriptive  to  perfonnance 
methods  has  policy  impacts  for  the  government  and  its  constituents. 

In  the  UK,  Europe,  and  Pacific  Asia,  prescriptive  building  regulations  that  had 
been  in  place  for  many  years  have  given  way  to  perfonnance-based  solutions.  In  the  UK 
for  example,  prescriptive  building  regulations  that  had  evolved  from  the  1666  Fire  of 
London  had  grown  to  more  than  300  pages.  The  government  initiated  an  effort  to 
increase  design  flexibility — and  “produce  a  more  intelligent  system” — by  publishing  its 
23-page  Building  Regulations  that  still  covered  essential  safety,  health,  and  comfort 
standards  (Meacham,  1998a,  p.  13).  Similarly,  the  Japanese  rewrote  their  building 
standards  law  into  The  Total  Fire  Safety  Design  System  of  Buildings  (Japan  Ministry  of 
Construction,  as  cited  in  Meacham,  1998a).  In  Australia,  a  Building  Regulation  Review 
Task  Force  developed  the  first  draft  of  that  country’s  performance-based  code,  the 
National  Building  Fire  Safety  System  Code  (Meacham,  1998a). 

In  the  United  States,  the  local  or  state  jurisdictions  must  promulgate  and  enforce 
building  and  fire  safety.  Not  only  is  this  an  authority  vested  in  the  states  by  the  U.S. 
Constitution,  but  it  has  historical  precedent  as  well.  In  the  United  States,  individual  states 
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and  communities  often  developed  their  own  building  and  fire  safety  codes.  In  an  article 
on  regulatory  barriers  to  innovation  and  marketing  residential  properties,  Oster  and 
Quigley  (1977)  found  “the  bewildering  variation  in  local  regulations  may  very  well  mean 
that  potentially  profitable  innovations  are  also  illegal  in  many  geographical  areas.  This 
reduces  both  the  scale  at  which  an  innovation  can  be  marketed  and  its  profitability,  and 
may  further  discourage  R  &  D  investment”  (p.  363).  They  added,  “Ideally,  construction 
standards  would  be  a  codification  of  performance  specifications  for  newly  constructed 
dwellings”  (p.  365). 

In  1927,  the  West  Coast  Fire  and  Building  Officials,  later  known  as  the 
International  Conference  of  Building  Officials,  published  the  first  “model”27  prescriptive 
building  code,  the  Uniform  Building  Code  followed  by  the  Standard  Building  Code, 
published  by  the  Southern  Building  Code  Congress  International  in  1946,  and  the 
Building  Officials  and  Code  Administrator’s  National  Building  Code  published  in  1950 
(Bukowski,  1997).  All  these  documents  established  prescriptive  design  requirements,  and 
generally  were  updated  on  a  three-year  cycle  to  meet  changing  technology  and  market 
conditions. 

The  three  organizations  competed  for  primacy  with  the  building  and  related 
construction  codes  until  1994  when  the  groups  merged  to  fonn  the  ICC  that  now 
publishes  the  prescriptive  International  Building  Code.  In  2001,  the  ICC  published  the 
first  American  perfonnance-based  code,  the  ICC  Performance  Code  for  Buildings  and 
Facilities.  Another  organization,  the  National  Fire  Protection  Association,  publishes  a 
competing  building  code  containing  perfonnance-based  elements,  NFPA  5000,  Building 
Construction  and  Safety  Code.  The  National  Fire  Protection  also  produces  NFPA  101, 
Life  Safety  Code  that  includes  a  variety  of  performance-based  design  solutions  within  its 
criteria. 

In  1993,  in  Status  of  Performance  Fire  Codes  in  the  USA,  Snell  summarized  the 
current  state  of  perfonnance-based  design  acceptance  within  the  United  States.  He  found 

27  Model  codes  are  intended  to  be  sufficiently  generic  so  that  any  community  code  can  adopt  them  as 
published,  which  results  in  a  comprehensive  and  legally  defensible  set  of  building  regulations. 
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that  while  the  potential  benefits  of  design  freedom  and  cost  saving  were  admirable,  the 
research,  technological,  and  legal  foundations  for  the  method  had  not  yet  gained 
acceptance.  He  optimistically  expressed  that  modem  advances  in  computing, 
telecommunications,  simulation,  and  expert  systems  would  offer  exciting  mechanisms  to 
solve  many  of  the  design  and  application  challenges  (Snell,  1993). 

Meacham  (1998b),  a  prolific  author  and  advocate  for  perfonnance-based  fire  safe 
building  design,  summarized  the  state  of  its  acceptance  in  Concepts  of  a  performance- 
based  building  regulatory  system  for  the  United  States.  The  report  provided  input  on  why 
the  United  States  was  moving  toward  a  perfonnance-based  design  system,  what 
components  were  needed  to  make  it  work,  and  what  education  and  qualifications  issues 
needed  to  be  addressed  among  practitioners  and  regulatory  officials. 

Bukowski  (1997)  pointed  out  that  a  significant  cultural  shift  among  designers, 
engineers,  and  code  enforcement  officials  will  be  needed  to  embrace  the  move  to 
performance-based  designs.  This  change  will  require:  1)  better  training  and  education,  2) 
consensus  upon  which  analytical  techniques  and  data  are  appropriate  for  assessing 
designs,  and  3)  recognition  that  perfonnance  based  designs  will  rely  on  new  fire 
protection  system  technology  more  than  fire-resistive  construction  and  materials. 

In  a  legal  context,  Coglianese,  Nash,  and  Olmstead  (2004)  reported  that 
“expanding  the  use  of  perfonnance-based  regulation  holds  promise  for  achieving  health, 
safety,  and  environmental  goals  at  a  lower  cost  and  for  doing  so  in  a  way  that 
accommodates  if  not  encourages  technological  innovation”  (p.  723).  In  their 
Performance-Based  Regulation:  Prospects  and  Limitations  in  Health,  Safety  and 
Environmental  Protection,  they  found  the  design  and  cost-savings  advantages  of 
performance-based  regulation  do  not  necessarily  mean  it  is  always  the  best  regulatory 
strategy. 

In  “Risk-Informed  Performance-Based  Approached  to  Building  Regulation,” 
Meacham  (2010)  reported  a  growing  worldwide  interest  in  combining  risk  analysis  and 
engineering  data  with  stakeholder  interests  to  establish  meaningful  perfonnance  levels 

and  criteria.  Meacham  stated  that  “keys  to  success  include  providing  thorough  yet 
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transparent  decision  framework,  adequate  data  and  analysis  tools,  and  good  stakeholder 
communication”  (p.  892)  all  of  which  should  be  readily  available  in  the  federal 
government  decision-making  environment. 

I.  ALTERNATE  VIEWS 

Some  are  circumspect  about  performance-based  design.  Most  notably,  attorney 
and  University  of  Maryland  School  of  Fire  Protection  Engineering  professor  Vincent 
Brannigan  has  written  extensively  in  American  journals  and  periodicals  regarding  his 
concern  that  although  technical  inputs  can  be  provided  in  performance-based  designs,  the 
unpredictable  “human  factor”  may  obviate  a  successful  fire  outcome  (Brannigan  & 
Smidts,  1999).  He  also  expressed  concern  that  no  public  policy  mandate  exists  to  move 
from  the  traditional  prescriptive  methods  of  design  and  construction,  and  what  constitutes 
a  reasonable  level  of  safety  is  ill-defined  in  the  performance-based  design  vernacular 
(Brannigan,  2001b). 

In  2002,  Brannigan  expressed  additional  concerns  about  perfonnance-based 
designs  that  may  not  consider  the  full  impact  of  events  that  threaten  buildings. 

Arson  is  a  special  issue  for  perfonnance-based  design  because  of 
engineering  design  optimization,  a  well-known  problem.  Highly 
engineered  structures  have  clear-cut  design  specifications,  but  if 
something  isn’t  reflected  in  the  requirements,  the  structure  may  not  be  able 
to  handle  the  problem.  The  engineers  who  optimized  the  Titanic  designed 
it  to  hit  icebergs  head  on,  not  to  scrape  along  the  side.  The  engineers  who 
designed  airbags  made  them  safe  for  the  5-foot-9-inch,  160-pound 
passenger,  but  fatal  to  shorter  people.  (Brannigan,  2002) 

He  was  equally  concerned  that  the  recently  developed  ICC  Performance  Code  for 
Buildings  and  Facilities  was  legally  flawed  as  a  regulatory  statute  because  its  overall 
social  objective  for  fire  safety  was  not  clearly  articulated  in  legal  terms  (Brannigan, 
2001a).  In  2002,  Brannigan  softened  his  position  somewhat  and  encouraged  the  use  of 
“proportionate  response”  cited  in  the  ICC  Performance  Code  for  Buildings  and  Facilities 
where  the  design  and  response  of  the  building  is  proportionate  to  the  potential  fire  threat 
(Brannigan,  2002). 
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Babrauskas  (n.d.)  in  “Performance-Based  Building  Codes:  What  Will  Happen  to 
the  Levels  of  Safety?”  argued  that  successful  strategies  for  perfonnance-based  design  can 
be  implemented,  but  that  designers  and  regulatory  officials  should  proceed  cautiously 
before  accepting  them  as  a  wholesale  solution  to  fire  protection  challenges. 

The  final  consideration  is  that  to  develop  a  workable,  safe  perfonnance- 
based  building  code  is  a  very  difficult  endeavor.  Many  of  the  prerequisites 
needed  are  simply  not  in  place  today.  Thus,  working  towards  the  day  when 
FSE-based  [fire  safety  engineered]  fire  safety  designs  will  flourish  is  a 
noble  effort,  but  precipitous  haste  is  not.  The  consequences  of  such  haste 
are  likely  to  be  erection  of  buildings  with  serious  fire  safety  shortcomings. 

(P-7) 

Snell  (1993)  cited  opponents  who  argued  that  the  adoption  of  performance-based  designs 
would  increase  design  complexity  and  cost.  In  Hong  Kong,  Lo,  Lam,  Yuen,  and  Fang 
(2003)  found  that  building  code  officials  there  generally  supported  perfonnance-based 
designs  but  were  suspect  of  the  state  of  the  engineering  studies  and  analytical  tools  used 
to  justify  the  method. 

Mirkah  (1997a)  reported  a  reluctance  on  the  part  of  many  code  officials  to  accept 
perfonnance-based  design  applications  because  of  their  lack  of  knowledge  regarding  both 
complex  fire  behavior  and  sophisticated  computerized  fire  effects  modeling  techniques 
often  used  to  demonstrate  that  a  proposed  fire  protection  design  was  satisfactory  to 
provide  an  acceptable  level  of  safety  for  occupants,  fire  fighters,  and  the  structure.  He 
added  that  many  code  officials  believed  they  may  be  vulnerable  personally  to  tort  liability 
claims  should  the  proposed  design  fail  with  resulting  deaths,  injuries,  or  damages  if  the 
project  did  not  meet  the  articulated  requirements  of  a  prescriptive  code.  Finally,  Mirkah 
found  a  general  distrust  of  fire  protection  engineers  who  represented  a  permit  applicant. 
According  to  Mirkah,  code  officials  were  suspect  that  the  engineers  may  not  have  been 
entirely  objective  since  the  developer  is  paying  them.  Later,  Siu  (2005)  made  the  same 
finding  that  code  officials  had  not  obtained  a  comfort  level  with  fire  protection  engineers 
because  the  discipline  was  relatively  new  compared  to  architecture  or  other  engineering 
fields. 
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Finally,  while  Lucht  et  al.  (2003)  support  the  policy  and  cost  benefits  of 
perfonnance-based  design,  they  acknowledge  that  “significant  gaps  in  the  data  and 
knowledge  base  needed  to  support  performance-based  codes,  engineering  tools, 
predictive  models,  and  risk  assessment”  remain  (p.  3). 

J.  LITERATURE  GAPS 

Although  rich  and  diverse  sources  of  literature  on  building  construction,  fire 
protection,  performance-based  designs,  fire  and  human  behavior  research,  computerized 
fire  modeling,  federal  facilities,  and  terrorist  threats  do  exist,  significant  gaps  remain  in 
the  literature  that  combines  this  topic  into  a  single  framework. 

First,  because  they  do  not  include  measurable  objectives,  prescriptive  designs  and 
codes  have  not  been  subjected  to  critical  post-incident  analysis  to  evaluate  if  they 
perfonned  as  the  persons  involved  in  the  consensus-based  development  process  expected 
they  would.  Many  articles  and  legal  cases  assess  the  perfonnance  of  individual  building 
components  or  sub-systems,  or  assign  liability  where  failures  occurred,  but  no  overall 
evaluation  of  whether  the  deemed-to-satisfy  approach  created  a  safe  building 
environment.  Building  and  fire  code  changes  that  occur  over  time  often  are  the  consensus 
response  to  significant  tragedy. 

Likewise,  no  literature  assesses  the  post-incident  perfonnance  of  buildings  or 
facilities  constructed  with  performance-based  designs;  thus,  it  is  impossible  to  determine 
if  the  initial  design  objectives  were  met.  As  time  passes  and  buildings  that  employed 
perfonnance-based  designs  suffer  fires,  an  opportunity  exists  to  evaluate  the  results. 
Given  well-developed  criteria,  the  chance  to  compare  perfonnance-based  and  prescriptive 
designs  also  exists  to  determine  if  one  is  preferable  to  the  other. 

Considering  the  number,  size,  and  value  of  federal  government  real  property 
assets,  comprehensive  studies  of  fire  and/or  arson  incidents  and  their  impact  on  both 
physical  property  and  continuity  of  operations  are  in  order.  It  is  remarkable  the  GSA,  the 
government’s  largest  non-military  property  manager,  has  no  meaningful  instrument  to 
collect  and  analyze  fire  and/or  arson  incidents,  especially  since  it  has  been  more  than  10 
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years  since  the  GAO  identified  this  shortcoming.  The  existing  method  of  collecting 
incident  infonnation  is  archaic  and  does  not  allow  for  detailed  analysis  so  the  GSA  can 
make  informed  planning  and  construction  decisions.  No  body  of  literature  enables 
government  policy  makers  to  make  rational,  performance-based  decisions  on  fire 
protection. 

The  literature  on  fire  modeling  and  design  fires  lacks  empirical  evidence  on  the 
impact  of  potential  arson  fire  scenarios,  including  the  use  of  large  quantities  of  flammable 
liquids,  multiple  fire  starts,  and  the  effects  of  compromised  fire  protection  systems  or  fire 
resistive  construction.  Most  fire  modeling  is  predicated  on  a  single  ignition  point  in  a 
nonnalized  (non-criminal)  environment. 

Combined,  these  gaps  show  that  no  consensus  method  exists  to  develop  threat 
scenarios  against  which  architects  or  engineers  can  design  so-called  permanent 
countenneasures.  This  study  will  add  to  the  literature  by  evaluating  one  of  the  3 1  design 
threats  developed  by  the  ISC  to  suggest  that  quantified  threat  scenarios  improve  the 
decisions  employed  for  the  Physical  Security  Criteria  for  Federal  Facilities  standard. 
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III.  FEDERAL  FACILITY  SAFETY  SINCE  1995 


The  means  of  protecting  federal  facilities  from  a  variety  of  terrorist  threats  has 
evolved  since  a  1995  attack  in  Oklahoma  City  that  killed  168  civilians,  including  19 
children.  Since  then,  the  federal  government  has  promulgated  a  variety  of  physical 
security  standards  intended  to  protect  occupants,  visitors,  facilities,  and  equipment  in 
existing  and  new  buildings  while  increasing  the  government’s  ability  to  be  resilient  in  the 
face  of  attack.  Most  of  these  standards  were  based  on  prescriptive  design  methods,  while 
more  recent  efforts  have  begun  to  implement  perfonnance-based  characteristics.  This 
section  reviews  the  recent  developmental  history  of  these  federal  standards. 

A.  VULNERABILITY  ASSESSMENT  OF  FEDERAL  FACILITIES  (1995) 

On  April  19,  1995,  Timothy  McVeigh  perpetrated  a  dramatic  and  deadly  act  of 
domestic  terrorism  when  he  bombed  the  Alfred  P.  Murrah  federal  building.  The  next  day, 
President  William  J.  Clinton  ordered  the  U.S.  Department  of  Justice  (DOJ)  to  conduct  a 
short-term  study  assessing  the  vulnerability  of  federal  office  buildings  to  terrorism  and 
other  acts  of  violence.  Seven  federal  agencies  participated  in  the  study,28  and  two 
working  groups  (a  Standards  Committee  and  Profile  Committee)29  were  created  to  meet 
the  President’s  ambitious  60-day  deadline.  The  survey  focused  on  the  GSA-controlled 
single  or  multi-tenant  office  buildings.  By  October  1995,  DOJ  issued  the  91-page 
Vulnerability  Assessment  of  Federal  Facilities  (hereafter  Vulnerability  Assessment )  report 
that  established  six  strategic  security  recommendations  and  created  52  recommended 
minimum-security  standards  for  federal  facilities.  The  recommendations  were  applicable 
to  existing  buildings,  but  did  not  include  standards  for  new  construction. 


28  The  DOJ  (including  the  U.S.  Marshals  Service  [that  served  as  the  lead  agency]  and  Federal  Bureau 
of  Investigation),  the  GSA,  the  Department  of  Defense,  the  Secret  Service,  the  Department  of  State,  the 
Social  Security  Administration,  and  the  Administrative  Office  of  the  U.S.  Courts. 

29  The  Standards  Committee  developed  minimum-security  standards.  The  Profile  Committee  was 
tasked  to  survey  sample  federal  facilities  to  determine  existing  security  features,  and  identify  future  security 
enhancements  and  costs. 
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The  strategic  recommendations  included:  1)  bringing  federal  facilities  up  to 
minimum  security  levels  concomitant  with  their  assumed  vulnerability,  2)  establishing 
building  security  committees,  3)  reemphasizing  GSA’s  primary  responsibility  for 
implementing  federal  facility  security,  4)  creating  an  ISC,  5)  upgrading  the  FPS,  and,  6) 
using  tenant  rents  to  cover  the  cost  of  security  improvements.  Elements  of 
recommendations  1-4  are  addressed  within  this  study;  upgrading  the  FPS  and  evaluating 
recovery  costs  are  not. 

The  study  teams  determined  that  of  the  one  million  federal  civilian  employees, 
about  50%  worked  in  GSA-owned  or  controlled  space.  Almost  75%  worked  in  what  GSA 
called  a  “typical  single  or  multi-tenant  federal  office  building”  (U.S.  Department  of 
Justice,  1995),  and  the  DOJ  report  estimated  1,330  of  these  facilities  existed  in  the 
continental  United  States.30  The  typical  federal  building  generally  was  a  multi-story 
building  housing  more  than  80  employees,  containing  a  mix  of  federal  agencies,  most  of 
which  had  significant  needs  to  interact  unimpeded  with  the  public.  The  remaining  federal 
employees  worked  in  facilities  not  included  in  the  survey  sample,  including  special  use 
space,  such  as  laboratories,  national  parks,  nuclear  facilities,  military  installations,  or  post 
offices  (U.S.  Department  of  Justice,  1995). 

According  to  the  report,  “prior  to  the  study,  there  were  no  government-wide 
standards  for  security  at  federal  facilities,  and  no  central  data  base  of  the  security 
currently  in  place  at  such  facilities”  (U.S.  Department  of  Justice,  1995).  This  seminal 
effort  focused  on  perimeter,31  entry,  and  interior  security,  and  security  planning,  which 
created  a  scale  of  five  increasingly  restrictive  security  levels.  Although  criminal  and 
terrorist  acts  as  a  class  were  addressed,  the  term  “security”  was  not  defined  in  the  initial 
report,  nor  has  it  been  defined  in  subsequent  reports. 

Table  4  describes  the  five  recommended  security  levels  and  includes  examples 
cited  by  the  survey  teams.  The  criteria  are  very  prescriptive  (e.g.,  number  of  employees 

30  During  the  60-day  survey,  site  visits  were  made  to  1,239  locations  (U.S.  Department  of  Justice, 
1995). 

31  The  report  concluded  perimeter  security  (parking,  closed  circuit  television  monitoring  (CCTV), 
lighting,  and  physical  barriers  were  areas  outside  the  government’s  control. 
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and  building  area)  without  any  rational  justification  for  the  selected  values.  No 
justification  exists  that  a  building  housing  149  federal  employees  qualifies  as  Security 
Level  II,  but  one  with  just  two  more  employees  should  increase  to  Security  Level  III, 
which  is  an  example  of  prescriptive  standards  based  on  non-scientific,  subjective 
decisions. 


Table  4. 

Building  Security  Levels:  1995  Vulnerability  Assessment  (After:  U.S. 
Department  of  Justice,  1995,  pp.  2-3— 2-5) 

Security 

Level 

Criteria 

1 

A  building  that  has  10  or  fewer  federal  employees;  low  volume  of  public  contact  or 
contact  with  only  a  small  segment  of  the  population;  and  2,500  or  less  square  feet 
(232  m2)  of  space,  such  as  a  small  “store  front”  type  of  operation. 

II 

A  building  that  has  1 1  to  150  federal  employees;  moderate  volume  of  public 
contact;  2,500  to  80,000  fit2  (232  to  7  432  m2)  of  space;  and  federal  activities  that 
are  routine  in  nature,  similar  to  commercial  activities.  A  typical  Level  II  building 
is  the  Social  Security  Administration  Office  in  El  Dorado,  Colorado. 

III 

A  building  with  151  to  450  federal  employees;  moderate/high  volume  of  public 
contact;  80,000  to  150,000  ft2  (7  432  to  13  935  m2)  of  space;  and  tenant  agencies 
that  may  include  law  enforcement  agencies,  court/related  agencies  and  functions, 
and  government  records  and  archives.  A  typical  Level  III  building  is  the  Pension 
Building,  a  multi-tenant,  historical  building  on  5th  Street  Northwest,  in 

Washington,  D.C. 

IV 

A  building  that  has  45 1  or  more  federal  employees;  high  volume  of  public  contact; 
more  than  150,000  ft2  (13  935  m2)  of  space;  and  tenant  agencies  that  may  include 
high-risk  law  enforcement  and  intelligence  agencies,  courts,  and  judicial  offices, 
child  care  center  and  highly  sensitive  government  records.  A  typical  Level  IV 
building  is  the  Department  of  Justice  Building  on  Constitution  Avenue  in 
Washington,  D.C.,  and  the  Alfred  P.  Murrah  Building  would  have  been  assigned 
this  category. 

V 

A  building  that  contains  mission  functions  critical  to  national  security,  such  as  the 
Pentagon  or  CIA  Headquarters.  A  Level-V  building  should  be  similar  to  a  Level- 
IV  building  in  terms  of  number  of  employees  and  square  footage.  It  should  have  at 
least  the  security  features  of  a  Level-IV  building.  The  missions  of  Level-V 
buildings  require  that  tenant  agencies  secure  the  site  according  to  their  own 
requirements. 
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Noticeably  absent  was  any  reference  to  arson  as  a  potential  threat  because  the 
1995  report’s  contemporaneous  emphasis  was  on  mass  explosive  devices,  which  makes 
sense  given  the  nature  of  McVeigh’s  attack  mode,  and  the  criteria  and  deadline  under 
which  the  study  group  was  working  to  satisfy  the  President’s  order.  Two  references 
related  to  fire  protection  occur  in  the  report.  First,  as  listed  in  Table  5,  the  survey  teams 
found  approximately  76.9%  of  the  facilities  they  visited  were  outfitted  with  complete  fire 
detection/suppression  systems.  However,  the  data’s  validity  is  of  concern.  One  problem 
with  this  data  is  that  the  survey  instrument  used  does  not  discriminate  between  fire 
detection  and  fire  suppression32  systems  so  it  is  impossible  to  deduce  from  the  data  the 
number  of  facilities  protect  by  fire  detection,  fire  suppression,  or  both  types  of  systems. 
Secondly,  the  modifier  “complete”  is  not  explained;  therefore,  it  is  impossible  to 
detennine  the  actual  extent  of  protection  these  systems  provide. 


Table  5.  Surveyed  Facilities:  Fire  Protection  Features  (After:  U.S.  Department  of 

Justice,  1995,  p.  E-32) 


Protection  Level 

Facilities 

Estimated 

Percent 

Complete  fire  detection/suppression  system  covering 
all  areas  of  the  facility 

910 

76.9 

Fire  detection/suppression  system  covers  a  portion  of 
the  facility 

196 

16.6 

No  fire  detection/suppression  system  present 

77 

6.5 

Total 

1 ,1 83a 

100.0 

'The  survey  reported  1,239  site  visits  were  conducted.  No  explanation  was  given  for  the  data 


discrepancy. 

A  second  fire  reference  in  the  Vulnerability  Assessment  report  occurs  in  its  Appendix  B, 
“Details  of  Recommended  Security  Standards,”  under  the  category  of  access  control  with 


32  In  this  application,  fire  detection  refers  to  electronic  systems  for  detecting  heat,  smoke,  or  other 
combustion  products,  and  subsequently,  reporting  an  alarm.  A  fire  suppression  system  generally  implies 
automatic  sprinkler  systems  that  are  heat-activated  and  discharge  water. 
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the  recommendation  to  “upgrade  to  current  life  safety  standards:  required  for  all  facilities 
as  part  of  GSA  design  requirements  (e.g.,  fire  detection,  fire  suppression  systems,  etc.)” 
(U.S.  Department  of  Justice,  1995). 

One  of  the  report’s  recommendations  was  that  all  facilities  have  a  fonnal 
mechanism  for  addressing  security  issues,  and  the  responsibility  for  fulfillment  should  lie 
with  a  GSA-mandated  and  controlled  Building  Security  Committee  (BSC).  The  BSC33 
would  include  representation  from  all  agencies  occupying  the  building,  and  the  GSA 
would  designate  a  physical  security  specialist34  to  assist  the  committee.  The  BSC  was 
expected  to  evaluate  and  apply  appropriate  minimum  requirements  that  needed  to  be 
implemented  at  its  facility,  as  well  as  identify  other  building-specific  security  issues  (U.S. 
Department  of  Justice,  1995). 

Furthennore,  the  1995  report  stressed  the  important  role  the  GSA  played  in 
implementing  federal  facility  security.  By  law,35  only  the  Administrator  of  General 
Services  may  construct  a  non-military  or  non-postal  public  building,  and  is  authorized  to 
alter  it  by  delegating  that  responsibility  to  GSA  employees  and  agents,  but  the 
Vulnerability  Assessment  applied  only  to  existing  buildings.  The  Vulnerability 
Assessment  recommended  that  the  GSA  should  review  all  the  BSC  security  enhancement 
requests,  evaluate  how  approved  requests  should  be  amortized  into  tenant  rents,  and 
amend  the  GSA  facility  construction  master  planning  process  to  assure  that  only 
functionally  similar  agencies  are  housed  in  the  same  location  so  agencies  with  dissimilar 
missions  (e.g.,  law  enforcement  and  environmental  protection)  are  not  co-located  in  the 
same  facility  (U.S.  Department  of  Justice,  1995). 

The  Vulnerability  Assessment  concluded  that  “the  typical  federal  facility  at  each 
security  level  lacks  some  of  the  elements  required  to  meet  the  new  minimum  standards 

33  The  BSC  designation  eventually  morphed  into  Facility  Security  Committee  (FSC)  in  the  Physical 
Security  Criteria  for  Federal  Facilities  April  12,  2010  standard  (p.  12). 

34  Physical  security  specialists  develop  security  policy  and  design,  develop,  evaluate,  and  sometimes 
install  protection  systems  and  devices  to  insure  that  sensitive  information,  equipment,  and  other  material  is 
not  compromised,  sabotaged,  stolen,  misused,  or  subjected  to  terrorist,  malicious  mischief,  or  other  acts  of 
willful  interference  (U.S.  Office  of  Personnel  Management,  1987). 

35  See  40  U.S.C.  §  3302  (2010)  and  40  U.S.C.  §  581  (2010). 
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proposed  in  this  Study”  (U.S.  Department  of  Justice,  1995)  and  recommended  that,  where 
feasible,  each  federal  facility  should  be  brought  up  to  the  minimum  standards  proposed 
for  its  corresponding  security  level.  The  study  included  seven  reasons  for  the  current 
(1995)  security  levels. 

•  GSA’s  prior  security  levels,  like  most  agencies  before  the  Murrah 
Building  bombing,  were  directed  at  a  different  kind  of  threat — protecting 
federal  workers  and  visitors  from  theft  or  assault — than  significant 
terrorist  attacks. 

•  Prior  to  the  study,  no  government-wide  standards  existed  for  security  at 
federal  facilities,  and  no  central  database  of  security  is  currently  in  place  at 
such  facilities  against  which  any  standards  could  be  measured. 

•  Violent  or  terrorist  threats  had  not  been  “an  overriding  factor  in  building 
design”  (U.S.  Department  of  Justice,  1995).  Tight  security  was  considered 
inimical  to  easy  citizen  access  for  high  service  levels. 

•  Agencies  with  differing  security  needs  often  shared  facility  space  leading 
to  inconsistent  application  of  security  measures. 

•  FPS  security  services  were  based  on  a  periodic  risk  assessment  process. 

•  The  typical  local  organizational  structure  was  insufficient  to  meet  tenant 

security  needs,  especially  where  multi-tenant  facilities  existed.  No  formal 
relationship  existed  between  FPS  and  the  tenants  for  conflict  resolution. 

•  Facility  security  efforts  were  sometimes  fragmented,  with  different 

agencies  assigned  to  perfonn  different  functions  within  the  same  facility 
(U.S.  Department  of  Justice,  1995). 

The  report  recommended  that  because  each  federal  building  was  unique — and  the 
feasibility  of  upgrading  existing  conditions  was  dependent  upon  building-specific  facts — 
security  issues  should  be  addressed  at  the  building-level  security  committee,  with  follow¬ 
up  analysis  perfonned  by  the  GSA. 

Most  significant  to  this  thesis,  the  1995  Vulnerability  Assessment  report 

recommended  the  creation  by  Executive  Order  (EO)  of  an  ISC  to  do  the  following. 

•  Establish  policies  for  building  security,  including,  but  not  limited  to,  those 
recommended  in  the  study 

•  Develop  a  strategy  for  ensuring  compliance  with  approved  standards 

•  Oversee  the  implementation  of  appropriate  security  measures  in  federal 
buildings 
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In  addition,  the  ISC  would  encourage  interagency  cooperation  on  security  issues, 
assess  technology  as  a  means  of  providing  cost-effective  security  enhancements,  assist  in 
budgeting  oversight  to  prioritize  federal  security  needs,  develop  long-term  construction 
standards  for  these  locations  with  threat  levels  or  missions  that  require  blast-resistant 
structures,  evaluate  standards  for  the  location  of — and  special  security  related  to — day 
care  centers  in  federal  facilities,36  and  assist  the  GSA  in  developing  and  maintaining  a 
centralized  security  database  (U.S.  Department  of  Justice,  1995).  The  Vulnerability 
Assessment  report  remained  in  effect  until  it  was  superseded  by  the  April  12,  2010 
issuance  of  the  Physical  Security  Criteria  for  Federal  Facilities,  discussed  later  in  this 
section. 


By  1998,  Peck,  in  testimony  before  the  Subcommittee  on  Public  Buildings  and 
Economic  Development  of  the  House  Committee  on  Transportation  and  Infrastructure, 
reported  that  90%  of  the  estimated  8,000  identified  security  upgrades  in  8,300  GSA 
controlled  buildings  had  been  made,  and  75%  of  the  recommended  countermeasures  had 
been  completed  (Peck,  1998).  However,  a  1998  report  from  the  General  Accounting 
Office  was  critical  of  the  GSA’s  progress  on  meeting  its  performance  goals,  and  that  the 
security  improvements  program  had  at  least  three  significant  flaws. 

GSA  has  not  established  several  key  program  evaluation  mechanisms  for 
its  building  security  program  that  could  assist  it  in  detennining  how 
effective  its  security  program  has  been  in  reducing  or  mitigating  building 
security  risks  or  in  shaping  new  security  program  initiatives.  These 
features  are  (1)  specific  goals,  outcomes,  and  performance  indicators  for 
the  security  program,  such  as  reducing  the  number  of  thefts  or 
unauthorized  entries;  (2)  establishing  and  implementing  systematic 
security  program  evaluations  that  would  provide  feedback  on  how  well  the 
security  program  is  achieving  its  objectives  and  contributing  to  GSA’s 
strategic  goals;  and  (3)  ensuring  that  a  reliable  perfonnance  data 
information  system  is  place.  (Ungar,  1998) 


36  Following  the  deaths  of  19  children  under  the  age  of  six  in  the  Alfred  P.  Murrah  Building  bombing, 
the  sensitive  nature  of  childcare  centers  located  in  federal  facilities  required  additional  special  attention. 
Any  facility  with  a  childcare  center  automatically  received  a  facility  population  score  of  “very  high.” 
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Ungar’s  testimony  introduced  the  concept  of  perfonnance-based  methods  for 
building  security.  Terms,  such  as  “specific  goals,  outcomes,  and  performance  indicators,” 
and  “achieving  objectives,”  move  from  the  prescriptive  approach  to  developing  design 
solutions  that  can  produce  measurable  results.  Ungar  further  suggested  that  revisions  in 
the  building  risk  assessment  methods — and  simultaneous  resumption  of  the  FPS’s 
periodic  risk  assessments — would  provide  a  means  to  analyze  the  effectiveness  of  the 
adopted  security  measures  and  whether  they  would  continue  to  be  appropriate  for  future 
threats  that  may  arise  (Ungar,  1998). 

B.  CREATION  OF  THE  INTERAGENCY  SECURITY  COMMITTEE  (1995) 

On  October  19,  1995,  President  Clinton  issued  Executive  Order  E012977,  which 
established  a  permanent  ISC  within  the  executive  branch  to  address  continuing 
government-wide  security  for  federal  facilities  (Smith,  2007).  In  language  nearly 
identical  to  that  recommended  in  the  Vulnerability  Assessment  report,  the  ISC  was 
chartered  to  establish  policies  for  security  and  protection  of  federal  facilities,  develop  and 
evaluate  security  standards  for  federal  facilities,  develop  a  strategy  for  ensuring 
compliance  with  such  standards,  and  oversee  the  implementation  of  appropriate  security 
measures  in  federal  facilities.  The  ISC  was  authorized  to  do  the  following. 

•  Encourage  agencies  with  security  responsibilities  to  share  security-related 
intelligence  in  a  timely  and  cooperative  manner 

•  Assess  technology  and  information  systems  as  a  means  of  providing  cost- 
effective  improvements  to  security  in  federal  facilities 

•  Develop  long-tenn  construction  standards  for  those  locations  with  threat 
levels  or  missions  that  require  blast  resistant  structures  or  other  specialized 
security  requirements 

•  Evaluate  standards  for  the  location  of,  and  special  security  related  to,  day 
care  centers  in  federal  facilities 

•  Assist  the  General  Services  Administrator  in  developing  and  maintaining  a 
centralized  security  database  of  all  federal  facilities  (Clinton,  1995) 

Table  6  identifies  the  member  agencies  and  representatives  of  the  original  ISC 
chaired  by  the  GSA  director. 
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Table  6.  Original  ISC  Representation  (After:  “Executive  Order  12977,”  1995) 


Department  of  Justice 

Department  of  the  Treasury 

Department  of  Commerce 

Department  of  the  Interior 

Department  of  Housing  and  Urban  Development 

Department  of  Labor 

Environmental  Protection  Agency 

Department  of  Transportation 

Office  of  Management  and  Budget 

Department  of  Veterans  Affairs 

Department  of  Agriculture 

Department  of  State 

Department  of  Health  and  Human  Services 

Department  of  Education 

Director,  United  States  Marshals  Service 

Department  of  Defense 

Director,  Security  Policy  Board 

Central  Intelligence  Agency 

Assistant  to  the  President:  National  Security  Affairs 

Department  of  Energy 

Assistant  Commissioner  of  the  Federal  Protective 
Service  of  the  Public  Buildings  Service 

GSA 

The  ISC  created  four  working  groups  to 

distribute  work  and  accomplish  its 

charter.  Table  7  summarizes  the  assignments  each  committee  was  given  within  the  ISC’s 

overall  framework. 

Table  7.  ISC  Working  Groups  (After:  Holt,  2010) 

Working  Group 

Assignment 

Provided  overall  project  guidance,  established  priorities, 
recommended  specific  projects  and  initiatives. 

Coordinated  development  and  review  of  all  ISC  physical 
security  standards. 

Identified  best  practices  in  security  technology  and 
provided  guidance  on  cost-effective  use  of  new 
technology  to  supplement  and  reinforce  other  security 
measures. 

Provided  subject-matter  expertise  on  best  practices  in 
providing  agencies  with  mechanisms  to  support  security 
programs,  while  integrating  information  management 
controls  through  a  collaborative  effort. 


Steering  Subcommittee 


Standards  Subcommittee 


Technology  Best 
Practices  Subcommittee 


Convergence  Subcommittee 
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C.  GSA  SECURITY  CRITERIA  (1997) 

In  January  1997,  the  GSA  completed  its  first  draft  of  a  document  entitled  GSA 
Security  Criteria,  which  was  revised  and  issued  on  October  8,  1997,  to  establish  design 
standards  for  the  protection  of  federal  employees  in  new,  significantly  renovated,  and 
long-term  leased  civilian  facilities  (U.S.  General  Services  Administration,  1997). 
Nationally  critical  Level  V  facilities,  defined  in  Table  3,  were  outside  the  scope  of  the 
new  standard.  The  GSA  document  attempted  to  integrate  security  requirements 
throughout  all  functional  and  design  phases  of  the  building  process,  including  site  and 
interior  space  planning,  as  well  as  structural  and  electrical  design  elements  (Smith,  2007). 

While  sensitive  to  the  earlier  DOJ  criteria  of  Building  Security  Levels,  the  GSA 
approach  included  a  mix  of  other  categories  beyond  building  size  and  population,  which 
introduced  value-laden  criteria,  such  as  symbolism,  mission  criticality,  consequences  of 
attacks,  and  threat  vulnerabilities.  Table  8  summarizes  the  categories  and  criteria. 


Table  8.  Categories  and  Criteria  (From:  U.S.  General  Services  Administration,  1997) 

_ Category _ Criteria _ 

Any  thing  or  place  for  which  a  popular  recognition  exists  of  an 
object,  name,  or  governmental  activity  by  virtue  of  its  historic 
Symbolic  significance,  its  size,  its  uniqueness,  or  its  context  with  specific  ideas 

or  sets  of  values  or  attitudes. 


Degree  to  which  a  building  houses  operations  and  functions  critical 
Mission  criticality  to  national  interests  of  the  United  States. 

Impact  of  an  attack  on  a  facility,  including  injuries  and  the  loss  of 
life;  damage  to  the  property  or  assets;  interruption  of  the  work  done 
Consequence  at  the  facility;  and  the  time  needed  to  repair,  replace,  or  bypass  the 
building  to  continue  the  work. 


Manifested  effects  of  a  criminal  or  criminal-like  event  that  would 
involve  the  loss  of  life  or  the  causation  of  injuries  at  to-be-defined 
levels.  May  also  be  the  loss  of,  or  damages  to,  tangible  or  intangible 
High  consequences  assets  or  the  loss  of  irreplaceable  assets  and  resources,  all  of  which 
have  significant  worth  on  a  national  scale,  and  not  limited  to 
monetary  considerations. 
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Category _ Criteria _ 

Terrorist  threats,  including  bombs,  chemical  attacks,  and  biological 
Threat  attacks,  or  crime  threats,  based  on  local  crime  indexes. 

Threat  information  authenticated  by  an  official  intelligence  or  law 
enforcement  agency  based  on  highly  trusted  sources  or  methods,  and 
Verified  threat  included  information  that  a  specific  location  or  agency  will  be 
attacked  within  a  contemporary  time  frame. 


Abandoning  the  DOJ  Vulnerability  Assessment  Levels  I  through  V,  the  GSA 
created  its  own  alphabetical  list  of  four  protection  levels  intended  to  be  combined  with 
threat  and  risk  analyses  to  provide  an  assessment  framework  to  measure  the  extent  and 
cost  of  security  features  based  on  potential  criminal  or  terrorist  threats.  Table  9 
summarizes  the  GSA  protection  levels.  Table  10  describes  the  crime  or  threat  levels 
detennined  to  exist  where  the  facility  would  be  constructed. 


Table  9.  GSA  Protection  Levels:  1997  (After:  U.S.  General  Services  Administration, 

1997) 


Protection 

Level 


D 


Application 

When  a  building  element3  or  building  needs  a  high  level  of  protection  that  would 
tend  to  be  used  when  a  building  is  a  national  symbol  or  of  critical  importance; 
and  when  its  damage  or  loss  will  have  high  consequences,  and  when  a  verified 
high  threat  exists. 


When  a  building  element  or  building  needs  a  medium-to-high  level  of  protection 
that  would  tend  to  be  used  when  a  building  is  a  regional  symbol  or  has  a 
C  significant  impact  on  the  government’s  mission,  and  when  its  damage  or  loss 

will  have  high  consequences;  and  when  a  verified  threat  exists. 


When  a  building  element  or  building  needs  a  medium-to-low  level  of  protection. 
This  level  would  tend  to  be  used  when  the  building  is  a  regional  symbol  or  has 
B  an  impact  on  the  government’s  mission,  and  when  its  damage  or  loss  will  have 

moderate  consequences;  and  when  a  suspected  threat  exists. 


When  the  building  element  or  building  does  not  need  higher  protection.  This 
A  level  would  tend  to  be  used  when  the  building  is  of  low  consequence  and  when 

an  unknown  threat  exists. 


“Building  elements  includes  foundations,  structural  framing,  exterior  and  interior  walls,  roofs,  and  internal 
systems,  such  as  heating,  ventilation,  air  conditioning,  electrical,  plumbing,  and  fire  protection  systems. 
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Table  10. 

Protection  Level  and  Crime/Terrorist  Threat  Levels  (After:  U.S.  General 
Services  Administration,  1997) 

Protection 

Level 

Crime/Terrorist  Threat  Levels 

D 

When  a  high  local  crime  index  exists,37  when  the  building  houses  critical 
operations,  or  when  it  has  high  asset  value. 

C 

When  a  medium  local  crime  index  exists,  when  the  building  houses 
sensitive  operations,  or  when  it  has  moderate  asset  value. 

B 

When  a  low  local  crime  index  exists,  when  the  building  houses  routine 
operations,  or  when  it  has  low  asset  value. 

A 

When  the  facility  is  small  and  has  a  very  low  local  crime  index,  when  the 
building  houses  routine  operations,  and  when  it  has  very  low  asset  value. 

N/A 

Not  applicable. 

Using  the  characteristics  described  in  Tables  8  and  9,  design  professionals  could 
develop  a  matrix  of  protection  levels  for  the  various  elements  that  comprise  the 
construction,  sub-systems,38  and  security  operations  of  a  federal  facility.  The  first  step  in 
the  analysis  was  to  conduct  a  security  assessment  categorizing  the  facility  for  criminal 
and  terrorist  threats  using  guidance  from  the  two  tables.  Then,  a  panel  of  security,  blast, 
intelligence,  and  technical  experts  were  expected  to  review  the  results  to  “ensure  the 
application  of  appropriate  and  cost-effective  security  measures,  and  give  the  design  team 
building-specific  security  criteria  to  work  with”  (U.S.  General  Services  Administration, 
1997,  p.  5).  The  resulting  matrix  allowed  that  a  facility  might  have  different  performance 
categories  applied  to  each  of  its  building  systems  so  the  highest  threat  level  across  any 
row  of  cells  dictated  the  minimum  protection  level  for  the  building  element. 


33  Index  crimes  are  the  eight  crimes  the  FBI  combines  to  produce  its  annual  crime  index.  These 
offenses  include  willful  homicide,  forcible  rape,  robbery,  burglary,  aggravated  assault,  larceny  over  $50, 
motor  vehicle  theft,  and  arson  (Federal  Bureau  of  Investigation,  2002). 

38  Including  mechanical,  electrical,  plumbing,  conveyance,  heating,  ventilation,  air  conditioning,  and 
fire  protection  systems. 


56 


Figure  1  is  a  matrix  of  the  results  for  a  hypothetical  building  where  intelligence 
and  security  analysts  provide  guidance  from  Table  10  that  the  specific  building  is 
identified  as  being  in  a  neighborhood  with  a  very  low  local  crime  index  (Protection  Level 
A).  However,  evidence  exists  of  a  limited  bomb  threat  (Protection  Level  B),  a  verified 
biological  threat  of  moderate  consequence  (Protection  Level  C),  and  a  verified  chemical 
threat  of  high  consequence  (Protection  Level  D).  The  left  vertical  axis  labeled  “Building 
Element”  includes  some  of  the  components  that  comprises  the  construction  and  operation 
of  a  building.  While  not  clearly  articulated  in  the  descriptors,  fire  protection  features, 
such  as  fire  resistant  construction,  or  automatic  fire  suppression  systems,  typically  could 
appear  in  one  or  more  of  the  categories,  such  as  building  facade  and  interior  walls  (as  fire 
resistant  construction),  and  mechanical  systems,  electrical  systems,  and  security  systems 
(as  fire  detection  or  suppression  systems).  The  category  security  operations  is  neither 
clearly  defined  nor  explained  in  the  report.  From  the  text,  it  appears  to  include  human 
elements,  such  as  guard  and  employee  training,  operations  plans,  and  emergency  plans, 
and  therefore,  is  not  included  in  this  analysis  of  the  built  environment. 

In  this  hypothetical  example,  the  threats  to  the  first  three  items  (mechanical 
systems,  windows,  and  security  systems),  range  left-to-right  from  low  to  high  (A  to  D),39 
and  since  the  high  consequence  threat  from  chemical  attack  is  rated  D,  the  protection 
level  for  those  particular  building  elements  must  meet  Level  D,  a  so-called  “high  level  of 
protection”  (from  Table  9)  but  still  does  not  specify  how  the  elements  should  perform 
when  subject  to  an  attack.  For  comparison,  the  highest  level  of  protection  for  stand-off 
distance,  building  facades,  interior  walls,  or  electrical  systems  only  reaches  Protection 
Level  B. 


39  The  protection  of  mechanical  systems  is  not  applicable  to  criminal  threats  in  this  assessment 
method. 
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Building  Element 

Crime 

Threats 

Bomb  Biological 

System  Protection 
Level 

Chemical 

Mechanical  systems 

N/Aa 

B 

C 

D 

D 

Windows 

A 

B 

C 

D 

D 

Security  systems 

A 

B 

C 

D 

D 

Stand-off  distance 

A 

B 

N/A 

N/A 

B 

Building  fa£ade 

A 

B 

N/A 

N/A 

B 

Interior  walls 

N/A 

B 

N/A 

N/A 

B 

Electrical  systems 

A 

B 

N/A 

N/A 

B 

Security  operations 

A 

B 

C 

D 

D 

aNot  applicable. 

Figure  1 .  Hypothetical  Federal  Facility  Protection  Level  Assessment  (After:  U.S. 

General  Services  Administration,  1997) 


Once  the  system  protection  level  was  established,  designers  were  expected  to  find 
“corresponding  protective  measures  in  the  engineering  criteria”  included  in  the  GSA 
Security  Criteria 40  document  (U.S.  General  Services  Administration,  1997).  However, 
the  engineering  criteria  were  vague,  and  generally  included  prescriptive  requirements. 
For  example,  the  reference  to  protecting  fire  protection  water  supplies  provides 
unjustified  prescriptive  dimensions  from  high  threat  areas, 

The  fire  protection  water  system  should  be  protected  from  single  point 
failure  in  case  of  a  blast.  The  incoming  line  should  be  encased  or  buried, 
or  located  50’  away  from  high  threat  areas  such  as  loading  docks,  front 
entrances,  and  parking,  and  the  interior  mains  should  be  looped  and 
sectionalized.  (U.S.  General  Services  Administration,  1997,  p.  66) 


40  In  deference  to  the  political  and  emotional  sensitivity  of  childcare  centers  after  the  Murrah  Building 
bombing,  the  report  included  these  prescriptive  requirements:  “Child  care  centers  may  be  located  anywhere 
in  low  risk  buildings.  In  medium  to  high-risk  buildings  and  courthouses,  they  should  not  be  within  100  feet 
from  the  main  public  entrance  or  a  loading  dock.  They  should  also  be  placed  1 00  feet  away  from  public 
parking  unless  there  are  compensating  blast  design  measures”  (U.S.  General  Services  Administration, 

1997,  pp.  7-8). 
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The  design  intent  of  a  performance-based  engineered  approach  is  clear;  protect 
the  system  from  a  single  point  failure  in  case  of  a  blast.  However,  the  size  and  nature  of 
the  potential  blast  and  its  distance  from  the  fire  protection  water  system  is  not  specified; 
therefore,  it  is  impossible  for  a  designer  to  develop  perfonnance  criteria  to  comply  with 
this  requirement.  Conversely,  the  arbitrary  prescriptive  requirement  to  encase,  bury,  or 
locate  the  supply  50  feet  (15  m)  from  one  or  more  parts  of  a  building  cannot  be  justified 
without  a  combined  analysis  of  the  site,  soil  conditions,  building  configuration,  or  threat. 

D.  ISC  SECURITY  DESIGN  CRITERIA  FOR  NEW  FEDERAL  OFFICE 

BUILDINGS  AND  MAJOR  MODERNIZATION  PROJECTS  (2001) 

The  GSA  and  the  U.S.  Department  of  State  convened  a  symposium  in  November 
1999  to  discuss  the  “apparently  conflicting  objectives  of  providing  security  from  terrorist 
attack  while  designing  public  buildings  in  an  open  society”  (Knoop  et  ah,  2001).  The 
GSA  and  State  rejected  the  idea  that  rigid,  prescriptive  design  approaches  provided  the 
solution  to  the  security/openness  paradox  and  “challenged  the  design  and  security 
professions  to  find  aesthetically  appealing  architectural  solutions  that  achieve  both 
security  and  physical  protection;  a  balanced,  performance-based  approach  to  security 
[emphasis  added]  and  openness”  (Knoop  et  ah,  2001,  p.  2).  With  this  challenge,  the  GSA 
and  State  opened  the  door  to  the  performance-based  design  approach  in  federal  facilities 
where  security  issues  were  concerned. 

In  May  2001,  the  ISC  issued  new  guidance,  the  Security  Design  Criteria  for  New 
Federal  Office  Buildings  and  Major  Modernization  Projects  (ISC  Security  Criteria), 
based  on  the  five  security  levels  for  federal  facilities  developed  in  the  1995  Vulnerability 
Assessment  report.  It  did  not  include  the  more  subjective  criteria  described  in  the  GSA 
Security  Criteria  (1997)  (see  Tables  8  and  9). 

According  to  Smith  (2007),  new  ISC  security  requirements  for  construction 
projects  strongly  emphasized  protection  from  explosives  used  in  terrorist  attacks.  The 
new  ISC  requirements  included  the  use  of  glazing  protection  to  enhance  blast-resistance 
for  windows,  the  establishment  of  distances  that  buildings  should  be  set  back  from  the 
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street  (called  set-back  or  stand-off  distances),  vehicular  access  control  to  buildings,  and 
the  placement  of  air  handling  intakes  to  prevent  the  introduction  of  airborne 
contaminants.  Two  draft  documents,  one  that  addressed  entry  security  technology,  and 
the  second,  which  pertained  to  preparedness  for  nuclear,  biological,  and  chemical  attacks, 
were  not  issued  officially  by  the  ISC  membership  (Smith,  2007). 

The  Office  of  the  Chief  Architect  of  the  Public  Buildings  Service  (an  office 
within  the  GSA)  asked  the  National  Research  Council  (NRC)  to  establish  a  panel  of 
design  and  construction  experts  to  evaluate  the  criteria  to  detennine  if  they  “might  be  too 
prescriptive  to  allow  a  design  professional  ‘reasonable  flexibility’  in  achieving  desired 
security  and  physical  protection  objectives”  (Knoop  et  ah,  2001,  p.  2).  The  resulting 
Committee  to  Review  the  Security  Design  Criteria  of  the  ISC  comprised  representatives 
from  the  disciplines  of  architecture,  structural  and  fire  protection  engineering,  blast- 
effects  mitigation,  physical  security,  and  risk  analysis  and  management. 

The  Committee  to  Review  the  Security  Design  Criteria  (Review  Committee)  was 
critical  of  the  2001  ISC  Security  Criteria. 

The  document  in  general  appears  to  be  a  mix  of  performance  objectives, 
prescriptive  requirements,  and  references  to  industry  standard  designs.  The 
committee  believes  that  although  full  implementation  of  all  the  ISC 
criteria  will  provide  some  protection  for  building  occupants  against  most 
blast-resistant  threats  and  should  significantly  reduce  injuries,  the 
organization  of  the  document  makes  it  difficult  to  identify  clearly  the 
connections  between  the  specific  criteria  and  the  perfonnance  objectives 
they  are  meant  to  achieve.  It  is  also  difficult  to  identify  clearly  how  some 
criteria  apply  to  specific  components  of  building  design.  Because  this  is  a 
critical  element  on  a  performance-based  design  process,  the  committee 
believes  that  rectifying  this  shortcoming  should  be  given  priority.  (Knoop 
et  ah,  2001,  p.  2) 

Using  the  ICC’s  2001  edition  of  the  International  Performance  Code  for 
Buildings  and  Facilities  as  a  model,  the  Review  Committee  outlined  how  a  performance- 
based  design  approach  could  be  used  to  achieve  the  desired  security  and  safety  concerns 
while  maintaining  open  access  to  employees  and  the  public.  The  Review  Committee  also 
pointed  out,  however,  “the  document  is  also  focused  on  the  terrorist  vehicle  bomb  as  the 
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primary  means  of  attack;  there  is  little  guidance  on  defending  federal  buildings  and  their 
occupants  from  chemical,  biological,  or  radiological  weapons”  (Knoop  et  ah,  2001,  p. 
41).  Likewise,  arson  or  fire  threats  were  relegated  to  the  category  of  naturally  occurring 
hazards  and  were  mentioned  rarely.  Without  addressing  these  and  other  threats,  the 
Review  Committee  reported,  the  outcome  could  result  in  “building  perfonnance  not 
being  considered  comprehensively — for  instance,  failure  to  design  for  survivability  of 
fire  protection  systems  after  a  bomb  attack  could  result  in  an  otherwise  avoidable  post¬ 
attack  fire”  (Knoop  et  ah,  2001,  p.  41). 

While  encouraging  greater  reliance  on  performance-based  design  to  meet  a 
variety  of  security  challenges,  the  Review  Committee  acknowledged  a  role  for 
prescriptive  design  and  improvements  in  design  guidance  remained. 

The  continued  use  of  both  prescriptive  and  performance  criteria  is 
appropriate  for  several  reasons,  including  the  fact  that  in  much  of  the 
building  design  process  using  prescriptive  criteria  need  not  limit  creative 
design.  Perfonnance  analysis  and  design  are  only  needed  for  certain 
portions  of  the  process,  for  example,  the  design  of  glazing  to  satisfy  a 
unique  threat  or  location.  Structured  appropriately,  prescriptive  criteria  can 
be  a  means  of  meeting  performance  objectives.  However,  the  ISC  Security 
Criteria  do  not  provide  guidance  on  the  amount  and  completeness  of 
information  to  be  provided  in  documenting  a  perfonnance-based  security 
design.  (Knoop  et  ah,  2001,  p.  42) 

The  Review  Committee  issued  a  set  of  13  short-  and  long-term  recommendations 
to  improve  the  implementation  of  the  ISC  Security  Criteria  while  simultaneously 
enhancing  security.  One  included  encouraging  the  ISC  and  its  member  agencies  to  begin 
a  comprehensive  and  timely  review  of  the  ISC  Security  Criteria  to  include  the  “creation 
of  risk  assessment  and  management  tools  as  well  as  policy  guidance  for  physical 
protection  and  security  to  guide  the  development  of  risk  reduction  strategies  and  a 
performance-based  design  process”  (Knoop  et  ah,  2001,  p.  46). 
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E.  BUILDING  SECURITY:  ISC  HAS  HAD  LIMITED  SUCCESS  IN 
FULFILLING  ITS  RESPONSIBILITIES  (U.S.  GENERAL  ACCOUNTING 
OFFICE,  2002) 

Meanwhile,  the  GSA  conducted  an  independent  review  of  the  ISC,  and  reported 
the  interagency  group  had  made  little  progress  on  some  of  its  assigned  responsibilities. 
While  acknowledging  the  ISC  had  developed  and  issued  security  design  criteria  and 
minimum  standards  for  building  access  procedures,  and  served  as  a  forum  for  its  working 
groups  to  discuss  security  related  issues: 

it  had  made  little  or  no  progress  in  other  elements  of  its  responsibilities, 
such  as  developing  and  establishing  policies  for  security  in  and  protection 
of  federal  facilities,  developing  a  strategy  for  ensuring  compliance  with 
security  standards,  overseeing  the  implementation  of  appropriate  security 
in  federal  facilities  and  developing  a  centralized  security  database  of  all 
federal  facilities.  (U.S.  General  Accounting  Office,  2002) 

The  GAO  report  reemphasized  the  NRC  Review  Committee’s  findings  that  the 
ISC  lacks  “performance  goals  and  measures”  (U.S.  General  Accounting  Office,  2002, 
p.  16).  The  GAO  blamed  the  shortcomings  on  a  lack  of  consistent  and  aggressive 
leadership  in  the  General  Services  Administration,  inadequate  staff  support  and  funding 
for  the  ISC,  and  ISC’s  own  difficulty  in  making  decisions.  The  GAO  acknowledged  the 
GSA  was  taking  steps  to  correct  the  problems.  Since  the  GAO  report  was  produced  at  the 
time  Congress  was  considering  creation  of  the  DHS,  the  GAO  recommended  that  the 
Director  of  the  Office  of  Management  and  Budget41  work  with  the  DHS,  the  GSA  and 
other  entities  to  address  the  report’s  recommendations  with  whichever  agency  assumed 
responsibility  for  protecting  federal  facilities.  Additionally,  the  GAO  report  suggested 
that  during  its  deliberations,  Congress  considers  clarifying  the  proposed  DHS’s 
jurisdiction  on  security-specific  matters  for  federal  facilities  among  the  agencies  that 
eventually  would  become  DHS  components. 


41  At  the  time,  the  Office  of  Management  and  Budget  was  both  represented  on  the  ISC  and  responsible 
for  heading  the  government’s  efforts  to  establish  the  DHS  (U.S.  General  Accounting  Office,  2002). 
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After  the  passage  of  the  Homeland  Security  Act42  and  the  eventual  creation  of  the 
DHS,  the  chainnanship  of  the  ISC  was  transferred  from  the  GSA  Administrator  to  the 
Secretary  of  the  DHS  and  a  GSA  representative  was  added  to  the  ISC’s  membership. 
Within  the  DHS,  the  ISC  chairmanship  subsequently  was  delegated  to  the  director  of  the 
FPS  (Smith,  2007). 

F.  ISC  SECURITY  STANDARDS  FOR  LEASED  SPACE  (2004) 

Following  the  issuance  of  the  1995  Vulnerability  Assessment,  some  agencies 
reported  that  the  standards  guidance  was  not  suitable  for  most  locations  that  the  federal 
government  leased,  and  the  result  was  an  apparent  double  standard  for  facilities  leased  or 
owned.  The  DHS  reported  that: 

providing  the  level  of  security  control,  access  control,  guard  service, 
magnetometers,  garage  control,  setbacks,  etc.  recommended  by  the  DOJ 
study  and  attainable  in  a  federally  owned  location,  is  not  easily  attainable 
in  the  typical  10,000  square-foot  lease  [929  m2].  (U.S.  Department  of 
Homeland  Security,  2004,  p.  3) 

In  response  to  these  concerns,  the  ISC  created  a  Lease  Security  Subcommittee  to 
develop  a  separate  set  of  standards  for  leased  properties.  The  standards  relied  on  four  of 
the  five  security  levels43  recommended  in  the  1995  assessment,  but  were  modified  for  the 
needs  of  leased  spaces  where  real  property  improvements  were  under  the  control  of  the 
property  owner,  not  the  tenant.  Major  structural  changes,  facade  reconstruction,  interior 
improvements,  and  blast  protection  were  limited;  however,  all  Level  II  through  IV  leased 
spaces  were  required  to  install  shatter-resistant  material  on  exterior  windows  to  reduce 
the  threat  of  flying  shards  resulting  from  a  perimeter  explosion.  The  security  standards 
for  leased  space  were  issued  September  29,  2004.  Meanwhile,  an  updated  version  of  2001 
Security  Design  Criteria  for  New  Federal  Office  Buildings  and  Major  Modernization 
Projects  was  approved  by  the  ISC  membership  the  same  day. 

42  Public  Law  107-296,  116  Stat.  745,  enacted  November  25,  2002. 

43  While  the  1995  Vulnerability  Assessment  included  five  levels,  the  highest  (Level  V)  was  applicable 
only  to  highly  secured  facilities  with  a  national  security  mission,  which  was  not  likely  found  in  a  leased 
commercial  space. 
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G.  HOMELAND  SECURITY:  FURTHER  ACTIONS  NEEDED  TO 
COORDINATE  FEDERAL  AGENCIES’  FACILITY  PROTECTION 
EFFORTS  AND  PROMOTE  KEY  PRACTICES  (U.S.  GOVERNMENT 
ACCOUNTABILITY  OFFICE,  2004) 


In  2004,  the  GAO  produced  an  analysis  of  ISC  performance  to  date  for  the  U.S. 
House  of  Representatives  Committee  on  Government  Refonn.  The  report  indicated  while 
the  ISC  had  made  progress  in  federal  facility  protection  efforts,  it  still  fell  short  in  several 
key  areas  including  planning,  the  development  of  goals  and  objectives,  and  coordination 
among  federal  agencies  required  to  meet  ISC  standards  (U.S.  Government  Accountability 
Office,  2004). 

The  GAO  report,  Homeland  Security:  Further  Actions  Needed  to  Coordinate 
Federal  Agencies  ’  Facility  Protection  Efforts  and  Promote  Key  Practices,  identified  six 
key  practices  that  together  could  enable  federal  agencies  to  obtain  a  more  comprehensive 
approach  to  physical  security.  Table  1 1  summarizes  the  six  key  practices  and  the 
descriptions  provided  in  the  GAO  study. 


Table  1 1 .  Key  Practices  in  Facility  Protection  (After:  U.S.  Government  Accountability 

Office,  2004) 

_ Key  Practice _ Description _ 


Allocating  resources 
using  risk  management 


Leveraging  technology 


Information  sharing 
and  coordination 


Performance  measurement 
and  testing 


Identify  threats,  assess  vulnerabilities,  and  determine 
critical  assets  to  protect  and  use  information  on  these  and 
other  elements  to  allocate  resources  as  conditions  change. 

Leverage  technologies  to  enhance  facility  security  through 
methods  like  access  control,  detection  and  surveillance 
systems. 

Establish  means  of  coordinating  and  sharing  security  and 
threat  information  with  other  government  entities  and  the 
private  sector. 

Use  metrics  to  assure  accountability  for  achieving  program 
goals  and  improve  security  at  facilities. 
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Key  Practice 

Description 

Aligning  assets  to  mission 

Align  assets  to  mission  and  relocate  staff  to  reduce 
vulnerabilities,  to  the  extent  agencies  have  excess  and/or 
underutilized  facilities. 

Strategic  management  of 
human  capital 

Strategically  manage  human  capital  to  maximize 
government  performance  and  assure  accountability  in 
facility  protection. 

The  GAO  found  during  the  course  of  its  study  a  number  of  federal  agencies  had 
begun  using  one  or  more  of  the  key  practices  in  assessing  and  improving  their  facility 
protection,  but  systemic  problems  still  existed  including  “developing  quality  data  that 
form  the  basis  for  risk  management,  ensuring  that  technology  will  perform  as  expected, 
and  determining  how  to  measure  the  true  impact  that  various  approaches  have  on 
improving  protection”  (U.S.  Government  Accountability  Office,  2004,  p.  5).  This 
conclusion  emphasized  the  value  of  performance-based  methods  in  facility  security 
design  because  it  allowed  designers  and  tenants  to  address  articulated  risks  and  select 
from  a  variety  of  engineered  solutions  to  improve  protection.  Two  of  the  key  practices 
identified  in  Table  1 1  are  directly  related  to  the  precepts  of  performance-based  design, 
allocating  resources  using  risk  management,  and  performance  management  and  testing 
using  metrics  to  assure  accountability  in  design  outcomes. 

Regarding  the  application  of  risk  management  principles  to  facility  security,  the 
GAO  report  commented  that  in  general  while  they  can  “take  on  various  forms,  our  past 
work  showed  that  most  risk  management  approaches  generally  involve  identifying 
potential  threats,  assessing  vulnerabilities,  identifying  the  assets  that  are  most  critical  to 
protect  in  terms  of  mission  and  significance,  and  evaluating  mitigation  alternatives  for 
their  likely  effect  on  risk  and  their  cost”  (U.S.  Government  Accountability  Office,  2004). 
This  comment  captures  the  key  characteristics  of  performance-based  design,  identify  one 
or  more  problems,  and  develop  design  solutions  to  address  them. 

The  GAO  in  2006  published  another  report  generally  critical  of  the  fact  no 
government-wide  guidance  nor  standard  existed  that  agencies  could  use  to  measure  the 
perfonnance  of  their  facility  protection  efforts  (U.S.  Government  Accountability  Office, 
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2006).  The  Government  Performance  and  Results  Act  of  1993  (GPRA)  required  program 
perfonnance  measurements  in  federal  agencies.44  The  GAO  studied  public-  and  private- 
sector  entities  in  the  United  States,  Australia,  Canada  and  the  UK  to  determine  how  they 
developed  physical  security  perfonnance  measures.  In  response,  the  ISC  implemented  its 
own  set  of  perfonnance  measures  for  security  improvements  with  the  2009  publication  of 
the  Interagency  Security  Committee  Use  of  Physical  Security  Performance  Measures. 

While  the  focus  of  the  document  was  on  the  effective  use  of  financial  resources 
primarily  to  satisfy  the  GPRA,  the  report  did  contextually  acknowledge  the  value  of 
perfonnance-based  approaches  as  part  of  an  overall  security  strategy. 

Without  effective  performance  measurement  data,  the  GAO  said  decision 
makers  may  not  have  sufficient  information  to  evaluate  whether  their 
investments  have  improved  security,  reduced  Federal  facilities’ 
vulnerability,  and  reduced  the  level  of  risk  to  an  acceptable  level.  (U.S. 
Department  of  Homeland  Security,  2009) 

The  conclusion  that  resources  cannot  be  managed  properly  without  effective 
performance  measures  is  equally  important  to  the  physical  security  design  professional. 
When  objective  measures  regarding  the  performance  of  security  countenneasures  are 
provided,  the  design  professional  can  develop  realistic  solutions  that  address  the  specific 
threat. 

H.  FACILITY  SECURITY  LEVEL  (FSL)  DETERMINA  TIONS  FOR  FEDERAL 
FACILITIES  (2008) 

In  2006,  the  ISC  elected  to  update  the  building  security  level  criteria  published  in 
the  1995  vulnerability  study  and  remained  unchanged  in  the  subsequent  years.  An 
Existing  Facilities  Security  Standards  Working  Group  was  established  to  review  and 
update  the  standards  in  light  of  newly  identified  threats,  such  as  those  posed  in  the 
September  11,  2001,  aircraft  attacks  on  the  World  Trade  Center  and  the  Pentagon  where 
fires  subsequent  to  the  aircraft  impact  resulted  in  substantial  deaths,  injuries,  and  damage. 
The  working  group  developed  a  16-page  standard,  published  in  2008,  that  defined  the 

44  Public  Law  No.  103-62,  107  Slat.  285,  enacted  August  3,  1993. 
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criteria  and  process  a  BSC  should  use  to  determine  its  facility  security  level  based  on 
mission  criticality,  facility  symbolism,  population,  size,  and  perceived  threat  to  tenant 
agencies.  The  standard  was  built  upon  the  five  security  levels  identified  in  the  1995 
vulnerability  assessment  (Table  4)  and  modified  subjective  criteria  borrowed,  in  part, 
from  the  1997  GSA  Security  Level  Criteria  (Table  8). 

Table  12  summarizes  the  latest  ISC  security  level  criteria  modified  from  the  DOJ 
and  GSA  models.  While  the  categories  mission  criticality,  symbolism,  and  threat  remain 
similar  to  the  1997  GSA  Security  Level  Criteria,  consequence,  high  consequences,  and 
verified  threat  were  deleted.  Facility  population  and  facility  size  (borrowed  from  the  DOJ 
1995  vulnerability  assessment)  were  substituted,  and  a  new  category  “intangible  factors” 
was  added. 


Table  12.  ISC  FSL  Criteria  (After:  U.S.  Department  of  Homeland  Security  2008) 

Category _ Criteria _ 

Facility  mission,  particularly  as  it  may  relate  to  national  essential 
Mission  criticality  functions45  and  other  important  business  of  the  government. 

External  appearances  or  well-known/publicized  operations  within  the 
facility  that  indicate  it  is  a  federal  facility,  and  the  potential  negative 
Symbolism  psychological  impact  of  an  undesirable  event  occurring  at  a  prominent 

federal  facility. 


Facility 

population 


Facility  size 


Peak  total  number  of  personnel  in  government  space,  including  employees, 
onsite  contract  employees,  and  regular  visitors. 

Square  footage  of  all  federally  occupied  space  in  the  facility,  including 
cases  in  which  an  agency  with  real  property  authority  controls  some  other 
amount  of  space  in  the  facility. 


Tenant  agency 
threat 


Nature  of  public  contact  required  in  or  resulting  from  the  conduct  of 
business  is  adversarial,  or  whether  a  history  of  adversarial  acts  committed 
at  the  facility,  against  facility  tenants,  or  against  the  tenant  agencies 
elsewhere  existed. 


45  National  essential  functions  are  “that  subset  of  essential  functions  that  are  necessary  to  lead  and 
sustain  the  Nation  during  a  catastrophic  emergency,  and  that,  therefore,  must  be  supported  through  the 
Continuity  of  Operations  (COOP)  and  the  Continuity  of  Government  (COG)  capabilities”  (U.S. 
Department  of  Homeland  Security,  2008,  p.  2). 
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Category 

Criteria 

Intangible  factors 

Reduced  value  of  the  facility  and  a  corresponding  reduction  in  the 
consequences  of  its  loss,  including  potential  for  cascading  effects  or 
downstream  impacts  on  interdependent  infrastructure,  or  costs  associated 
with  the  reconstitution  of  the  facility. 

The  Facility  Security  Level  Determinations  for  Federal  Facilities — An 
Interagency  Security  Committee  Standard  retained  some  of  the  criteria  from  the  1995 
vulnerability  assessment.  Federal  properties  be  assessed  periodically46  and  be  assigned  a 
FSL  ranging  from  I  (low  risk)  to  IV  (very  high).  Some  facilities,  because  of  mission 
criticality,  uniqueness  or  symbolism,  might  warrant  a  special  FSL  V  designation  (U.S. 
Department  of  Homeland  Security,  2008;  U.S.  Department  of  Homeland  Security, 
2010c). 

Figure  2  represents  the  FSL  determination  matrix  included  in  the  revised  standard. 
Using  the  matrix,  points  are  assigned  by  the  BSC  based  on  its  assessment  of  the  factors 
that  “make  the  facility  a  target  for  adversarial  acts  (threats),  as  well  as  those  that 
characterize  the  value  or  criticality  of  the  facility  (consequences)”  (U.S.  Department  of 
Homeland  Security,  2008;  U.S.  Department  of  Homeland  Security,  2010c).  The  sum  of 
the  assigned  points  established  the  preliminary  FSL  designation  (Table  13);  however,  the 
FSL  could  be  adjusted  one  level  by  the  BSC’s  assessment  of  the  “intangible  factors.”  The 
“intangible  factors”  and  any  adjustments  to  the  facility  level  score  had  to  be  justified  by 
the  BSC. 


46  According  to  the  standard,  security  assessments  for  Level  1  and  It  facilities  were  to  occur  every  five 
years,  and  every  three  years  for  Level  III,  IV  and  V  facilities  (U.S.  Department  of  Homeland  Security, 
2008;  U.S.  Department  of  Homeland  Security,  2010c). 
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Points 

Factor 

1 

2 

3 

4 

Score 

Mission 

criticality 

Low 

Medium 

High 

Very  High 

Symbolism 

Low 

Medium 

High 

Very  High 

Facility 

Population 

<100 

101-250 

251-750 

>750 

Facility 

size 

<10,000  ft2 

10,001-100,000  ft2 

100,001-250,000  ft2 

>250,000  ft2 

<  929  m2 

929-9  290  m2 

9  290-23  226  m2 

>  23  226  nf 

Threat  to 

Tenant 

Agencies 

Low 

Medium 

High 

Very  High 

Sum  of  Above 

Facility 

Security 

Level 

I 

5-7  points 

II 

8-12  points 

III 

13-17  points 

IV 

18-20  points 

Preliminary 

FSL 

Intangible 

adjustment 

Justification 

+/-1  FSL 

Final  FSL 

Figure  2.  ISC  FSL  Determination  Matrix  (After:  U.S.  Department  of  Homeland 

Security,  2008) 


Table  13.  Point  Value-Derived  FSL  (After:  U.S.  Department  of  Homeland  Security, 

2008) 


Total  Points 

Facility  Security  Level 

5-7 

I 

8-12 

II 

13-17 

III 

18-20 

IV 

The  Facility  Security  Level  Determinations  for  Federal  Facilities — An 
Interagency  Security  Committee  Standard  made  no  recommendations  regarding  physical 
security  construction,  threat  mitigation,  or  countermeasures.  The  BSC  was  required  to 
either  accept  the  risk  it  identified,  or  fund  security  measures  to  reduce  the  risk  (U.S. 
Department  of  Homeland  Security,  2008;  U.S.  Department  of  Homeland  Security, 
2010c). 
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Not  surprisingly,  given  the  broad  and  mostly  subjective  latitude  with  which  BSCs 
could  evaluate  their  facilities,  Smith  found  “the  successful  integration  of  the  federal 
government’s  facility  protection  standards  is  a  fonnidable  challenge  because  it  involves 
diverse  agencies  with  varying  perspectives  on  security  issues”  (Smith,  2007).  A 
perfonnance-based  approach  to  security  issues  would  enable  these  diverse  agencies  to 
identify  their  unique  security  challenges  and  address  them  with  customized  solutions. 

I.  PHYSICAL  SECURITY  CRITERIA  FOR  FEDERAL  FACILITIES  (2010) 

On  April  12,  2010,  the  ISC  released  the  complementary  documents  the  Physical 
Security  Criteria  for  Federal  Facilities  standard  and  the  DBT  report.47  Both  were  subject 
to  a  24-month  validation  period  before  they  were  finalized.  In  accordance  with  the 
recommendations  from  the  2004  GAO  report,48  the  Physical  Security  Criteria  for 
Federal  Facilities  standard  adopted  a  risk  management  approach  to  aid  in  identifying 
threats,  assessing  vulnerabilities,  determining  critical  assets  needing  protection,  adjusting 
resources  as  threat  conditions  changed,  and,  key  to  this  study,  selecting  countermeasures 
to  address  threats  and  vulnerabilities.  Using  a  13 -step  decision  point  flowchart  model 
(Figure  3)  and  several  tables  of  anticipated  threats  and  security  design  options,  the 
Physical  Security  Criteria  for  Federal  Facilities  describes  a  process  that  officials  can  use 
to  determine  the  security  measures  needed  at  a  federal  facility  (U.S.  Department  of 
Homeland  Security,  2010c).  The  new  document  replaces  the  1995  Vulnerability 
Assessment,  the  ISC  Security  Standards  for  Leased  Space,  and  the  ISC  Security  Design 
Criteria  for  New  Federal  Office  Buildings  and  Major  Modernization  Projects,  which 
consolidated  them  into  a  single  document.  The  standard  is  applicable  to  “existing 
buildings,  new  construction,  or  major  modernizations;  facilities  owned,  to  be  purchased, 
or  leased;  stand-alone  facilities,  Federal  campuses,  and  where  appropriate;  individual 


47  The  DBT  subsequently  was  updated  November  30,  2010. 

48  Homeland  Security:  Further  Actions  Needed  to  Coordinate  Federal  Agencies’  Facility  Protection 
Efforts  and  Promote  Key  Practices. 
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facilities  on  Federal  campuses;  and  special-use  facilities”49  (U.S.  Department  of 
Homeland  Security,  2010c,  p.  4). 

Application  of  the  new  standard  is  predicated  on  the  FSL  designation  utilizing  the 
assessment  methods  found  in  the  2008  standard  (Figure  2).  Once  a  security  assessment  is 
conducted  by  the  agency  or  component  responsible  for  physical  security  at  the  site,  the 
FSC  assigns  the  building  or  facility  a  baseline  level  of  protection  (LOP)  score,  which  is 
“the  degree  of  security  provided  by  a  particular  countermeasure  or  set  of  counter 
measures”  (U.S.  Department  of  Homeland  Security,  2010c,  p.  7).  The  FSL  (ranked  I-IV) 
becomes  the  foundation  for  decision  making  using  the  ISC  Risk  Management  Process 
identified  in  Figure  3.  This  fonnalized  risk  management  process  provides  the  FSC  a 
series  of  decision  points  where  the  committee  may  evaluate  its  security  features  to 
balance  the  LOP  against  the  perceived  risk. 

It  is  important  to  understand  the  word  “risk”  and  its  use  in  the  Physical  Security 
Criteria  for  Federal  Facilities  ’  narrative.  According  to  the  document,  risk  is  a  “measure 
of  the  potential  hann  from  an  undesirable  event  that  encompasses  threat,  vulnerability, 
and  consequence”  (p.  7).  In  this  context,  it  implies  that  hann  will  occur  and  can  be 
quantified.  This  perspective  is  similar  Purdy’s  findings  (2010)  that  “it  has  been  common 
for  risk  to  be  regarded  solely  as  a  negative  that  organizations  should  try  to  avoid  or 
transfer  to  others”  (p.  882).  The  International  Organization  for  Standardization  (ISO)  has 
developed  a  consensus  definition  of  risk  ideally  suited  to  both  the  Physical  Security 
Criteria  for  Federal  Facilities  and  the  application  of  performance-based  design  to 
minimize  the  consequences  of  unwanted  events.  In  the  new  ISO  definition,  risk  is  the 
“effect  of  uncertainty  on  objectives”  (p.  882).  In  this  context,  no  negative  connotation 
exists,  only  that  the  anticipated  results  might  be  altered  by  outside  influences;  therefore, 
risk  may  be  positive  or  negative. 


49  Example  of  special  use  facilities  "include  but  are  not  limited  to,  high-security  laboratories, 
hospitals,  aircraft  and  spacecraft  hangers  ,  or  unique  storage  facilities  designed  specifically  for  such  things 
as  chemicals  and  explosives”  (U.S.  Department  of  Homeland  Security,  2010c,  p.  14).  By  the  nature  of  their 
use  and  contents,  these  facilities  tend  to  be  a  high  fire  risk  or  an  arson  target. 
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In  the  ISC  model,  once  the  FSL  is  assigned  and  the  baseline  LOP  established,  the 
risk  management  process  requires  an  identification  and  assessment  of  threats  to  the 
facility  (Step  2).  To  aid  the  security  organization’s  assessment  process,  a  threat  list  of  29 
euphemistically  named  “undesirable  events”  was  included  in  the  original  document 
intended  to  provide  a  “conceptual  scenario  for  use  in  identifying  applicable 
countenneasures  when  applying  this  Standard”  (U.S.  Department  of  Homeland  Security, 
2010c,  p.  72). 50  The  security  analysis  is  required  to  assess  all  the  undesirable  events  on 
the  list.  Event  scenarios  ranged  from  ballistic  attacks  using  a  variety  of  weapons  to 
robbery,  theft,  and  unauthorized  surreptitious  entry  to  the  premises.  One  postulated  arson 
scenario  is  “an  attack  against  a  Government  facility  by  knowingly  and  willingly  setting  a 
fire  with  intent  to  cause  damage  or  destruction  to  the  facility  and/or  physical  injury  or 
loss  of  life  to  the  occupants”  (U.S.  Department  of  Homeland  Security,  2010c,  p.  72). 


50  A  later  version  of  the  DBT  increases  this  list  to  3 1 . 
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FSL 

Determination 


Step  1 

Identify  baseline 
Level  of  Protection 


Step  2 

Identify  and  assess  risks 


Evaluate  alternate  locations 


Step  3 
Risks  = 
baseline 


Step  4 

Determine  LOP  needed 
to  meet  risk 


Maintain  existing 
LOP 


Step  5 

Existing  LOP 
sufficient? 


Step  6 
Necessary 
LOP 

achievable? 


Step  7 

Determine  highest 
achievable  LOP 


Step  8 
Risk 

acceDtable? 


Step  9 
Alternate 
locations 
available? 


Plan  for  delayed 

NO 

implementation 

« - < 

Step  11 
Achievable 
immediately? 


Step  10 
Accept  risk 


Step  12 

Implement  interim 
countermeasures 


Step  1 3 :  Implement  permanent  countermeasures 


Figure  3.  ISC  Risk  Management  Process  (After:  U.S.  Department  of  Homeland 

Security,  2010c) 
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Step  3  in  Figure  3,  the  ISC  Risk  Management  Process,  is  the  first  decision  point, 
the  FSC  detennination  whether  the  baseline  LOP  adequately  addresses  the  risks  or  if  the 
LOP  should  be  adjusted.  If  the  FSC  determines  the  baseline  level  of  protection  is 
sufficient,  the  existing  protection  levels  are  deemed  adequate  and  no  further  security 
protections  are  required  (Step  5).  However,  if  the  FSC  detennines  the  existing  LOP  is 
insufficient  based  on  the  risks,  the  committee  must  determine  at  Step  6  if  the  necessary 
LOP  is  achievable:  “specifically,  if  the  countermeasure  can  be  physically  implemented, 
and  whether  the  investment  is  cost  effective”51  (U.S.  Department  of  Homeland  Security, 
2010c,  p.  27).  If  the  FSC  detennines  the  necessary  level  of  LOP52  is  not  achievable,  it 
must  establish  the  highest  achievable  level  of  protection  (Step  7).  Once  the  highest  LOP 
is  detennined,  the  FSC  must  decide  if  it  needs  to  find  alternate  locations  for  the  facility 
and  its  operations  (Steps  8  and  9)  or  is  willing  to  accept  the  risk  (Step  10). 

If,  at  Step  6,  the  FSC  detennines  the  necessary  level  of  protection,  or,  at  Step  10, 
accepts  the  existing  risk,  the  committee  is  required  to  detennine  if  the  required 
countenneasures  are  immediately  achievable  or  if  interim  countermeasures  are  required. 
Finally,  at  Step  13,  the  building  or  facility  is  required  to  implement  the  permanent 
countenneasures  needed  to  satisfy  the  level  of  protection  concomitant  with  the  facility 
security  level.  While  the  term  “pennanent  countermeasures”  is  not  defined  within  the 
standard,  an  appendix  of  security  measures  is  included  that  serves  to  address  the  various 
threats  identified  during  the  security  assessment.  Arranged  in  tabular  format,  the  security 
criteria  are  a  mix  of  vaguely  defined  prescriptive  and  perfonnance-based 
countermeasures  to  the  identified  threats.  Table  14  provides  an  example  of  how  the 
security  criteria  are  qualified  that  uses  four  security  criteria  generally  applicable  to  fire 
protection  and  arson  mitigation. 


5 1  Cost  effectiveness  is  measured  by  comparing  the  cost  of  the  countermeasure  improvement  to  the 
value  of  the  asset. 

52  Necessary  LOP  is  defined  as  "the  degree  of  security  determined  to  be  needed  to  mitigate  the 
assessed  risks  at  the  facility”  (U.S.  Department  of  Homeland  Security,  2010c,  p.  7). 
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Table  14.  Sample  ISC  Security  Measure  Details  (After:  U.S.  Department  of  Homeland 

Security,  2010c) 


Security  Criterion 

Detail 

Comply  with  applicable  regulations  regarding  storage  and  safety 
requirements. 

Hazardous  Materials 
Storage 

Depending  upon  the  nature  of  the  material,  measures  may  be  needed 
to  prevent  access  to,  release  of,  or  unauthorized  removal  of  the 
hazardous  material  from  the  site. 

Valves  and  control  mechanisms  also  must  be  protected  from 
unauthorized  access. 

Protection  of  Water 
Supply 

Reference  the  current  DBT  established  by  the  ISC,  unless  chemical, 
biological  or  radiation  threat  type  is  superseded  by  an  agency-specific 
threat  assessment. 

Emergency  Exit 
Doors 

Electronic  locks  on  perimeter  doors  must  fail-secure,  and  electronic 
locks  on  interior  doors  must  fail-safe,  if  such  measures  do  not  conflict 
with  applicable  fire  and  safety  codes. 

Security  of 
Ventilation 
Equipment  and 
Controls 

To  assure  heating,  ventilation  and  air  conditioning  system  operation 
cannot  be  disrupted  by  someone  physically  accessing  the  controls; 
equipment  should  be  located  in  a  secure  area  with  access  limited  to 
security  and  engineering  staff. 

Since  many  of  the  security  criteria  are  vaguely  defined,  and  simply  are 
instructions  selected  from  an  established  menu,  no  means  is  available  to  evaluate  their 
effectiveness  against  an  anticipated  threat.  For  example,  in  the  Table  13  security  criterion 
for  hazardous  materials  storage,  the  guidance  to  “comply  with  the  applicable  regulations 
regarding  storage  and  safety  requirements”  provides  only  a  directive  and  no  measure  of  a 
successful  outcome.  On  the  other  hand,  the  directive  that  “valves  and  control  mechanisms 
also  must  be  protected  from  unauthorized  access”  defines  the  desired  security  end  state. 
The  FSC  or  security  organization  can  establish  means  to  achieve  this  clear  performance 
objective. 

A  second  shortcoming  of  the  Physical  Security  Criteria  for  Federal  Facilities 
approach  is  its  emphasis  on  threats  that  primarily  are  manmade.  According  to  the  report, 
“other  threats  to  buildings,  such  as  earthquakes,  fire,  or  storms  are  beyond  the  scope  of 
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this  document  and  are  addressed  in  applicable  construction  standards  [emphasis  added], 
although  many  of  the  countermeasures  identified  will  contribute  to  mitigating  natural 
hazards”  (U.S.  Department  of  Homeland  Security,  2010c).  This  approach  presumes  the 
applicable  construction  standards — the  model  building  codes — are  adequate  to  protect 
against  these  and  other  natural  hazards.  The  model  building  codes  prescribe  only 
minimum  requirements,  and  do  not  have  measurable  outcomes  of  success.  To  say  a 
federal  building  or  facility  “meets  the  code”  is  no  assurance  it  will  survive  a  natural  threat 
since  the  scale  and  scope  of  the  threat  is  not  quantified  in  these  construction  standards.  In 
other  words,  no  performance  expectation  exists  in  the  model  construction  standards, 
especially  from  threats,  such  as  fire  or  arson. 

J.  THE  DBT  (2010) 

Simultaneous  to  the  release  of  the  Physical  Security  Criteria  for  Federal 
Facilities  standard,  the  ISC  published  a  companion  document,  the  DBT,  which  includes 
31  scenarios  potential  adversaries  might  employ  to  attack  federal  facilities.  The  DBT  was 
inspired  by  a  similar,  but  classified,  document  used  by  the  Department  of  Energy  (DOE) 
to  manage  potential  risks  (U.S.  Government  Accountability  Office,  2004).  The  scenarios 
expand  on  the  undesirable  events  enumerated  in  the  Physical  Security  Criteria  for 
Federal  Facilities  and  included  intelligence  community  assessments  of  the  likelihood  one 
or  more  of  the  scenarios  will  be  implemented  by  an  adversary.  As  the  ISC  developed 
threat  scenarios,  it  was  guided  by  the  importance  of  creating  specific  examples  for  which 
permanent  countermeasures  could  be  developed.  However,  the  companion  documents  fall 
short  of  this  objective  in  several  ways.  The  scenarios  are  inconsistently  defined,  and  some 
significant  (albeit  not  criminal)  threats  are  dismissed  as  outside  the  scope  of  the  work. 
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According  to  the  report,  the  intent  of  the  DBT  was  threefold. 

•  To  in forrn  the  deliberations  of  the  ISC  working  groups  as  they  establish 
standards 

•  To  support  the  calculation  of  risk  upon  threat,  vulnerability  and 
consequences,  to  a  facility,  when  applying  the  Physical  Security  Criteria 
for  Federal  Facilities 

•  To  detennine  the  specific  adversary  characteristics  that  perfonnance 
standards  and  countermeasures  are  designed  to  overcome  (U.S. 
Department  of  Homeland  Security,  2010a) 

It  is  the  last  bullet  that  this  thesis  addresses  with  the  hypothesis  that  the  described 
arson-specific  adversary  and  threat  characteristics  are  too  vague  to  enable  the 
development  of  effective  performance  standards  and  countenneasures  to  control  the  arson 
threat  and  consequences. 

In  developing  the  DBT,  the  ISC  was  challenged  by  the  changing  nature  of 
criminal  and  terrorist  threats,  and  recognized  that  a  more  flexible  approach  was  needed  to 
develop  design  standards  and  countenneasures.  According  to  the  DBT: 

First,  the  threat  was  typically  based  on  publicized  historical  events, 
leading  the  government  to  design  tomorrow’s  facilities  to  meet  yesterday’s 
threats.  Today’s  dynamic  threat  environment  suggests  a  need  to  react  to 
rapid  change.  The  elapsed  time  between  the  identification  of  a  need  for  a 
new  Federal  facility  and  the  time  it  is  occupied  can  be  as  long  as  7  to  10 
years.  In  that  time,  the  threat  has  likely  changed  substantially.  Previous 
standards  also  incorporated  aspects  of  the  threat  as  part  of  the  document 
itself,  which  made  it  difficult  to  keep  the  threat  current  without  updating 
the  entire  standard.  The  threat  changes  faster  than  working  groups  can 
develop  new  standards.  (U.S.  Department  of  Homeland  Security,  2010a,  p. 

1) 

Furthennore,  the  committee  recognized  that  a  “one  size-fits  all”  approach  to 
physical  security  design  was  not  appropriate  for  all  federal  facilities  depending  upon 
variables,  such  as  the  community  in  which  the  facility  was  located,  neighborhood 
conditions,  mission  and  operational  functions,  topography,  and  threats.  The  complexity  of 
these  variables — especially  threats — led  to  the  conclusion  that  prior,  more  generic 
methods  of  physical  security  assessments  were  not  working.  According  to  the  report: 
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the  validity  of  the  threat  is  routinely  called  into  question,  not  only  in  the 
characteristics  of  the  threat  itself  (e.g.,  device  size,  weapon  caliber, 
sophistication  of  the  adversary),  but  in  its  applicability  to  a  specific 
facility.  More  infonnation  was  needed  to  support  the  evaluation  of  the 
threat  as  it  pertains  to  the  estimation  of  risk  for  each  facility.  By  providing 
guidance  in  that  area,  the  consistency  of  threat  ratings  from  facility  to 
facility  is  improved.  (U.S.  Department  of  Homeland  Security,  2010a,  p.  1) 

In  numerous  references  throughout  the  DBT  document,  the  ISC  emphasized  the 
importance  of  “specific,”  “consistent,”  and  “detailed”  threat  scenarios  that  should  be  used 
for  countermeasure  selection  and  design.  At  one  point,  the  committee  reported: 

with  multiple  working  groups  developing  and  updating  a  variety  of  related 
standards,  the  need  for  consistent  infonnation  regarding  the  threat  to  serve 
as  the  basis  for  all  new  standards  is  paramount.  Each  working  group 
should  be  considering  the  same  threat  as  they  write  standards  to  counter  it. 

For  example,  in  establishing  standards  for  ballistic  resistance  of  protective 
vests,  a  working  group  developing  standards  for  contract  guards  should  be 
considering  the  same  weapons  as  a  working  group  considering  ballistic 
protection  around  a  screening  area.  (U.S.  Department  of  Homeland 
Security,  2010a,  p.  2) 

However,  most  of  the  31  threat  scenarios  included  in  the  DBT  are  vague  and 
immeasurable.  Without  specific  and  measurable  criteria  in  the  design  scenarios,  it  is 
impossible  for  a  FSC  or  designer  to  evaluate  if  the  security  objective  can  be  achieved. 
Even  the  arson  threat  scenarios  were  inconsistently  characterized  in  the  Physical  Security 
Criteria  for  Federal  Facilities  standard  and  two  locations  within  the  DBT.  Table  15 
compares  the  different  arson  threat  scenarios  employed  in  the  documents. 
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Table  15.  ISC  Arson  Threat  Scenarios  (After:  U.S.  Department  of  Homeland  Security, 

2010a) 


Source 

Page 

Threat  Description 

Physical  Security 
Criteria  for 
Federal  Facilities 

72 

An  attack  against  a  government  facility  by  knowingly  and 
willingly  setting  a  fire  with  intent  to  cause  damage  or  destruction 
to  the  facility  and/or  physical  injury  or  loss  of  life  to  the 
occupants. 

DBT 

12 

Accessing  a  facility  and  deliberately  setting  fire  to  the  facility  or 
to  assets  within  the  facility. 

DBT 

7.2.1 

An  adversary  places  an  improved  IID  containing  an  accelerant 
and  using  a  delay  mechanism  adjacent  to  a  facility,  but  outside 
the  view  of  security  countermeasures. 

From  a  design  perspective,  each  of  these  scenarios  describes  a  different  and 
unique  set  of  conditions  with  unspecified  outcomes.  Therefore,  the  contention  that  these 
events  are  “specific,”  “consistent,”  and  “detailed”  threat  scenarios  is  not  substantiated. 
Given  the  dynamic  nature  of  fire  behavior,  these  three  scenarios  might  have  dramatically 
different  results.  For  example,  the  threat  description  scenarios  could  range  from  a 
disgruntled  employee  setting  fire  to  his  workstation  to  an  adversary  tossing  a  flaming 
Molotov  cocktail  from  a  road  onto  a  nearby  airport  taxiway  where  little  or  no  damage 
might  occur.  The  scenario  frameworks  should  be  consistent  throughout  the  DBT  since  the 
countenneasures  designed  to  address  specific  threat  scenarios  could  differ  significantly. 
None  of  the  arson  scenarios  provides  the  specific  threat  characteristics  that  would  enable 
a  FSC  or  facility  designer  to  select  perfonnance  standards  and  countenneasures  designed 
to  overcome  the  threat  or  consequences. 

According  to  the  DBT  report,  quantifiable  measures  should  be  used  for  the 
development  of  countermeasures  to  defeat  or  mitigate  specific  events.  “For  example, 
when  it  is  necessary  to  protect  a  facility  against  a  vehicle-borne  improvised  explosive 
device  (VBIED),  the  device  size  specified  for  VBIED  events  should  be  used  for 
engineering  calculations ”  [emphasis  added]  (U.S.  Department  of  Homeland  Security, 
2010a,  p.  6).  Given  the  device  size,  ordnance  experts  and  forensic  analysts  are  capable  of 
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determining  the  area  of  influence  of  a  shock  wave,  detonation  or  deflagration  velocity 
and  pressure,  destruction  estimates,  and  casualty  predictions  within  the  blast  zone 
(Murray,  1998;  U.S.  Department  of  the  Air  Force,  2006).  Thus,  when  the  engineering  or 
scientific  data  exist  to  develop  countermeasures,  they  should  be  employed,  including  for 
arson  threats  where  critical  elements  within  the  scenarios  may  be  quantified  and 
appropriate  countenneasures  developed. 

Furthennore,  the  DBT  assumes  that  criminal  and  terrorist-initiated  “undesirable 
events”  are  somehow  different  from  other  environmental  threats.  This  presupposition  is 
made  in  the  standard  without  substantiation  and  without  acknowledging  that  the 
destructive  effects  of  other  threats  can  be  equally  damaging  to  the  built  environment. 
According  to  the  DBT,  “the  events  addressed  in  this  document  are  man-made.  Natural 
hazards  such  as  earthquakes,  floods,  fire,  or  wind  storms  are  beyond  the  scope  of  this 
document  and  are  addressed  in  applicable  construction  and  life  safety  standards”  (U.S. 
Department  of  Homeland  Security,  2010a,  p.  2).  This  conclusion  assumes  that  the 
applicable  construction  and  life  safety  standards  are  adequate,  but  the  report  provides  no 
justification  for  that  finding.  In  particular — other  than  events  caused  by  lightning — one 
could  argue  that  all  fires  are  manmade,  either  as  a  result  of  an  intentional  act  or  neglect  in 
employing  fire  safety  practices.  To  describe  fire  as  a  “natural  hazard”  and  ignore  its 
potential  effects  is  short  sighted,  and  to  assume  that  fire  prevention  and  mitigation  are 
addressed  satisfactorily  in  the  applicable  construction  and  life  safety  standards  is  a 
conclusion  not  quantified  by  the  ISC. 

Although  fire  research  and  engineering  are  relatively  young  fields  when  compared 
among  other  scientific  disciplines,  recognized  and  validated  methods  do  exist  to  quantify 
fire  behavior  in  the  built  environment,  which  is  discussed  in  greater  detail  in  Section  IV 
of  this  study.  The  ability  to  quantify  fire  behavior  with  some  degree  of  assurance  is  at  the 
core  of  performance-based  design  methods.  When  the  fire  threat — regardless  if  it  is  the 
result  of  a  terrorist  attack,  criminal  behavior,  or  a  natural  event — can  be  quantified, 
adequate  permanent  countenneasures  can  be  evaluated. 
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K.  SUMMARY 


The  physical  security  of  federal  facilities  assumed  a  new  urgency  when  the  Alfred 
P.  Murrah  Building  was  destroyed  by  a  domestic  terrorist  attack  in  1995.  Since  then, 
several  federal  agencies  have  developed  a  variety  of  security  and  construction  standards 
intended  to  enhance  safety  for  occupants,  operations,  and  the  non-military  facilities 
themselves.  Initially,  these  standards  were  intended  to  counter  terrorist  attacks  using 
explosive  devices,  but  have  evolved  into  covering  a  broad  range  of  criminal  and  terrorist 
threats.  Over  time,  responsibility  for  the  development  and  maintenance  of  these  standards 
was  assigned  to  an  ISC  within  the  DHS. 

As  they  developed,  most  of  the  physical  security  standards  cited  in  this  section 
were  built  upon  a  prescriptive  foundation;  guiding  agencies  to  achieve  a  desired  level  of 
protection  by  giving  precise  design  and  construction  advice.  Since  2008,  the  standards 
have  begun  a  slow  process  toward  the  development  and  implementation  of  performance- 
based  countenneasures.  An  important  next  step  is  to  quantify  critical  elements  within  the 
threats — especially  arson — in  terms  that  the  engineering  and  design  community  can 
translate  into  quantifiable  countermeasures. 


81 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


82 


IV.  DEVELOPMENTS  IN  CONSTRUCTION  METHODS  AND 
CODES  IN  THE  UNITED  STATES 


For  thousands  of  years,  man  has  provided  shelter  for  his  family  and  belongings  by 
erecting  some  sort  of  structure  to  protect  them  from  the  elements.  Whether  it  was  a  rude 
hut  or  sophisticated  multi-story  building,  these  creations  became  part  of  the  human 
landscape  known  as  the  built  environment.  This  built  environment  is  susceptible  to  any 
number  of  natural  or  manmade  threats  including  earthquake,  weather,  fire,  rodent  and 
insect  vectors,  explosion,  tsunami,  hazardous  material  release,  criminal  enterprise,  or 
terrorist  attack.  This  section  explains  recent  developments  in  regulations  intended  to 
strengthen  the  built  environment  in  the  United  States,  and  explores  the  differences 
between  traditional  prescriptive  and  contemporaneous  performance-based  designs  and 
codes. 

Initially,  building  construction  relied  on  craftsmen  who  translated  their  vision  or 
architectural  designs  into  practical,  usable,  and  often  breathtakingly  beautiful  structures. 
These  creations  were  limited  only  by  the  resources  at  hand:  money  and  labor  to  build, 
natural  materials,  such  as  wood  and  stone  to  create  the  buildings,  and  the  physical  limits 
of  these  natural  materials  to  support  themselves  and  the  structural  loads53  imposed  upon 
them.  As  communities  grew,  however,  social  demands  increased  for  safety  and  comfort 
in  the  built  environment.  Sanitation  controls  were  needed  to  prevent  the  spread  of 
disease.  Structural  requirements  were  implemented  to  prevent  buildings  from  collapsing 
during  routine  use.  Fire  protection  regulations  were  instituted  to  prevent  conflagrations. 
Ventilation  standards  were  instituted  to  improve  personal  comfort  and  health.  These 
requirements  eventually  became  fixed  in  locally  enforced  regulations  and  standards 
called  construction  codes,54  more  commonly  known  as  building  codes. 


53  “Loads”  describes  additional  weights  or  stresses,  both  static  and  dynamic,  which  are  applied  to  a 
building  during  its  lifetime.  The  building  itself  constitutes  a  “dead  load”  that  comprises  the  structural 
elements,  permanent  finishes,  and  attached  features,  such  as  air  handling  equipment  and  water  towers. 

54  Construction  codes  typically  comprise  structural  framing,  plumbing,  electrical,  mechanical,  fuel  gas, 
and  fire  protection  systems  that  go  into  the  completion  of  a  building. 
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Building  and  fire  codes55  frame  critical  infrastructure  protection  and  resilience 
requirements.  They  establish  a  community’s  minimum  acceptable  level  of  safety  and 
utility  within  the  built  environment.  Hospitals,  government  buildings,  schools,  factories, 
stores,  fire  and  police  stations,  warehouses,  single-family  dwellings  ...  all  are 
constructed  in  accordance  with  standards  of  design  based  on  locally  adopted  and  enforced 
building  codes.56  These  documents  are  intended  to  prescribe  requirements  for  safety  from 
earthquake,  weather,  fire,  or  commonly  recognized  technological  hazards,  as  well  as 
provide  for  comfort  and  sanitation  in  accordance  with  recognized  health  standards. 

Granted,  an  important  distinction  exists  between  building  design  and  code 
compliance.  According  to  Thomas,  “codes  are  minimums  set  by  the  community.  Designs 
are  comprehensive  plans  to  make  the  owner  and  hopefully  the  users  happy”  (D.  J. 
Thomas,  n.d.,  p.  3).  If  architectural  and  design  latitude  did  not  exist,  many  buildings 
would  be  nothing  more  than  utilitarian  shelters,  and  lack  the  beauty  and  inspiration  of  the 
some  of  the  nation’s  greatest  design  achievements.  Building  designers  and  tenants  are 
given  the  freedom  to  create  both  practical  and  striking  structures  that  meet  their 
functional  requirements  and  aesthetic  tastes.  Generally,  the  architect  or  designer  may 
create  a  building  from  any  materials  that  can  withstand  normal  operating  loads  and  the 
effects  of  threats,  such  as  high  winds,  snow,  earthquake,  or  fire.  While  architects  and 
tenants  have  the  autonomy  to  design  structures  that  meet  their  operational  needs  and 
artistic  expressions,  many  communities  imposed  regulatory  limitations  through  the 
adoption  and  enforcement  of  building  codes  in  the  interest  of  public  and  occupant  safety. 
These  regulations  establish  minimum  safety  levels,  and  in  some  circumstances, 
prescriptive  requirements  constrain  design  freedom  by  setting  arbitrary  limits  on  such 
things  as  building  height,  gross  floor  area,  exit  travel  distances,  and  the  use  of  specific 
materials  to  enhance  fire  resistance  and  structural  integrity.  Borrowed  and  adapted  from 


55  Fire  codes  often  are  considered  to  be  ‘'‘maintenance”  codes  that  prescribe  regulations  to  protect  new 
and  existing  buildings — and  their  tenants — from  fire  during  their  routine  occupancy. 

56  The  regulation  of  building  construction  generally  falls  under  state  and  local  government  police 
powers.  However,  it  is  acknowledged  that  not  all  jurisdictions  elect  to  adopt  and  enforce  building  codes. 
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the  SFPE  (National  Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers, 
2000),  for  the  purpose  of  this  study,  prescriptive  design  is: 

an  approach  where  safety  is  achieved  by  specifying  certain  construction 
characteristics  or  materials,  by  limiting  dimensions,  or  by  specifying 
protection  systems  without  referring  to  how  these  requirements  achieve  a 
desired  safety  goal.  (p.  9) 

The  distinction  between  design  and  codes  becomes  further  complicated  when 
properties  owned  by  the  U.S.  government  are  involved.  The  Commission  on  Engineering 
and  Technical  Systems  (Commission  on  Engineering  and  Technical  Systems,  1989) 
explained  that  “Federal  agencies  are  exempt  from  these  state  and  local  building  codes 
(and  from  zoning  laws  as  well),  and  are  entirely  responsible  for  all  aspects  of  safety  and 
health  in  their  buildings”  (p.  2).  This  freedom  enables  the  federal  government  to  set  its 
own  standards  for  design  and  safety.  However,  the  Public  Buildings  Act  of  198857 
specified  that  any  building  constructed  or  altered  by  the  GSA  or  any  other  federal  agency 
should  be  in  compliance — to  the  extent  feasible  as  detennined  by  the  GSA 
administrator — with  the  latest  published  edition  of  one  of  the  nationally  recognized 
model  building  codes  (Legal  Infonnation  Institute,  2011a).  The  GSA  administrator  may 
elect  to  decide  that  the  aesthetic  and  iconic  value  of  a  particular  design  outweighs  the 
feasibility  of  complying  with  building  safety  codes.  This  decision  may  be  especially 
opportune  when  trying  to  apply  current  construction  codes  to  historic  public  buildings, 
many  of  which  may  have  been  erected  before  specific  regulations  were  conceived, 
developed,  or  adopted.  Ironically,  this  latter  circumstance  bodes  well  for  the  opportunity 
to  apply  perfonnance-based  designs  where  modern  prescriptive  regulations  may  be 
impossible  to  meet. 

A.  EVOLUTION  OF  PRESCRIPTIVE  DESIGNS  AND  CODES 

In  the  United  States,  regulations  that  evolved  into  building  codes  began  as  fire 
prevention  and  control  laws  during  the  colonial  era.  They  were  intended  to  mitigate  the 


57  See  40U.S.C.  §3312. 
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consequences  of  sparks  from  chimneys  and  flames  from  cooking  fires  consuming  the 
many  wooden  structures  predominant  in  that  time.  Later,  in  19th  century  cities,  buildings 
were  constructed  so  close  together  they  created  fire  hazards  and  conflagration  potential. 
The  Great  Chicago  Fire  of  1871  that  destroyed  an  estimated  17,500  buildings  and  killed 
as  many  as  300  persons  highlighted  the  need  for  stronger  building  and  fire  codes 
(“Building  Codes,”  1994).  Many  cities  adopted  their  own  building  and  fire  safety  codes 
based  on  their  unique  conditions  of  topography,  weather,  building  materials,  and 
construction  practices.  In  1905,  the  National  Board  of  Fire  Underwriters  issued  the  first 
model58  code  developed  in  the  United  States,  the  Recommended  Building  Code  (later 
renamed  the  National  Building  Code)  (“Building  Code,”  1994).  Over  time,  other 
organizations  adopted  model  construction  codes,  including  the  International  Conference 
of  Building  Officials  (1927),  the  Southern  Building  Code  Congress  International  (1945), 
and  the  Building  Officials  and  Code  Administrators  (1950).  These  groups  competed  for 
representation  in  various  geographic  areas  of  the  United  States,  but  in  1994,  the 
organizations  merged  into  the  ICC.  Another  organization,  the  National  Fire  Protection 
Association,  produced  a  competing  set  of  construction  codes  and  standards.59 

Historically,  building  code  development  is  a  consensus  process,  with  a  nominal 
scientific  or  engineering  foundation.  Persons  representing  various  professional  disciplines 
or  commercial  interests  may  serve  on  one  or  more  technical  advisory  committees  that 
develop  codes  and  standards  to  address  various  elements  that  affect  building  construction 
and  safety.  Generally,  these  committees  follow  specific  procedures  to  assure  equal 
representation  of  all  interested  participants — including  the  general  public  that  may  not 
have  a  dedicated  place  on  the  committee — and  majority  votes  are  conducted  in 
accordance  with  legal  and  ethical  standards  to  adopt  or  alter  requirements.  This 
democratic  approach,  Brannigan  (2010)  claimed,  results  in  building  codes  that  “are  legal 
not  essentially  technical  documents”  (personal  communication,  September  16,  2010).  The 

58  A  “model”  code  is  one  created  by  one  or  more  interest  groups,  usually  having  special  expertise  in 
the  topic  that  may  be  legally  adopted  by  reference  by  a  community  that  does  not  have  its  own  code  or 
wishes  to  adopt  regulations  similar  to  other  jurisdictions. 

59  “The  fundamental  difference  between  a  code  and  a  standard  is  that  a  code  dictates  what  must  be 
done  while  a  standard  spells  out  how  to  do  it”  (Building  Technology,  1981). 
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basis  for  Brannigan’s  assertion  is  that  a  preponderance  of  the  proposed  and  adopted  code 
requirements  are  based  on  the  committee’s  majority  opinion  of  empirical  evidence,  and 
not  based  on  comprehensive  scientific  inquiry  or  experimentation.  This  opinion  is  shared 
in  a  report  commissioned  by  the  U.S.  Department  of  Housing  and  Urban  Development, 
“the  process  is  as  much  political  as  technical.  Perhaps  reflective  of  our  American  system 
of  government,  the  entire  process  is  known  as  ‘voluntary  consensus’”  (Building 
Technology,  1981,  p.  12).  The  Building  Technology  report  continues  by  stating  the 
following.. 

The  National  Building  Code  through  the  1931  edition  has  explanatory 
notes,  pictures  and  diagrams  throughout.  Today,  there  is  only  legalese,  too 
much  detail,  too  little  policy,  no  statement  of  intent,  and  far  too  many 
exceptions  to  poorly  stated  generally  rules.  This  lack  of  clarity  is  not  good 
for  existing  buildings  because  the  exercise  of  flexibility  and  good 
judgment  is  made  difficult  when  the  intent  is  not  clear.  (Building 
Technology,  1981,  p.  33). 

The  national  code-promulgating  organizations60  rely  on  committees  having 
various  levels  of  expertise  that  identify  problems,  offer  solutions,  and  develop 
recommendations  incorporated  into  the  codes.  While  scientific  and  engineering  studies 
about  specific  building  components  and  their  behavior  under  a  variety  of  conditions  may 
influence  the  committee  recommendations,  universal  application  of  these  tools  to  all  parts 
of  the  building  codes  does  not  exist.  As  far  back  as  1921,  then  Secretary  of  Commerce 
Herbert  Hoover,  created  a  Building  Code  Committee  at  the  National  Bureau  of 
Standards61  in  response  to  four  identified  defects  in  contemporary  building  laws:  1)  they 
raised  the  cost  of  building  and  made  the  building  industry  inactive,  2)  they  failed  to 
recognize  modem  methods,  3)  they  were  based  on  compromises  rather  than  scientific 
data,  and,  4)  they  lacked  unifonnity  in  principles  (Building  Technology,  1981). 


60  Today,  the  International  Code  Council  and  National  Fire  Protection  Association  remain  the 
predominant  code  and  standard  promulgating  organizations. 

61  The  former  National  Bureau  of  Standards  was  a  federal  research  laboratory  in  the  Department  of 
Commerce.  In  1988,  it  became  the  National  Institute  of  Standards  and  Technology  (NIST). 
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Most  current  codes  and  designs  are  “prescriptive,”  in  that  they  prescribe  specific 
minimum  rules  and  features  to  which  building  designs  must  adhere.  These  regulations 
can  run  to  hundreds  of  pages  of  very  explicit  criteria.  Every  building  is  assigned  a  “use” 
and  “occupancy”  class  that  establishes  the  framework  for  code  compliance.  For  example, 
according  to  the  International  Building  Code  (International  Code  Council,  2009),  a 
“place  of  public  assembly”  is  defined  as  a  building  where  “50  or  more  persons  gather  for 
the  purpose  of  worship,  entertainment,  drinking  and  dining,  education,  awaiting 
transportation,  or  deliberation.”62  Given  this  definition,  do  all  “places  of  public 
assembly”  have  the  same  inherent  hazards?  Does  the  McDonald’s  restaurant  on  the  street 
corner  have  the  same  safety  risks  as  New  York’s  Radio  City  Music  Hall?  Both  meet  the 
definition  of  “places  of  public  assembly,”  but  even  people  who  know  nothing  about  codes 
would  reason  they  do  not  possess  equal  threats  to  life  or  property  because  of  the  number 
of  people  who  might  be  inside  at  any  one  time  or  the  variety  of  potential  safety  hazards 
that  might  exist.  Why  are  prescriptive  designs  and  codes  a  problem?  Prescriptive  designs 
and  codes  employ  generic  solutions  applied  to  different  use  and  occupancy  situations  and 
may  not  adequately  address  the  overall  vulnerabilities,  risks,  and  hazards  needed  to  create 
a  resilient  infrastructure.  Prescriptive  codes  also  are  criticized  for  increasing  construction 
costs  while  discouraging  evolutionary  architectural  design  and  building  product 
innovation. 

Significant  prescriptive  code  changes  often  occur  as  the  result  of  a  tragedy  that 
captures  public  attention.  Following  the  2001  World  Trade  Center  attacks  where  fire 
fighter  access  and  occupant  evacuation  were  an  issue,  the  model  building  code  was 
amended  to  add  new  construction  requirements  for  special  elevators,  fire  protection 
systems,  and  high-perfonnance  fire  resistant  construction  in  so-called  ultra-high-rise 
buildings  that  exceed  420  feet  (128  m)  in  height  (National  Institute  of  Standards  and 
Technology,  2008).  After  100  nightclub  patrons  died  in  2003  in  a  fast-moving  fire  in 
Rhode  Island,  the  model  codes  adopted  requirements  for  automatic  fire  sprinklers  in 

62  This  example  is  a  classic  example  of  empiricism  in  prescriptive  codes.  The  number  of  people  that 
creates  a  defined  place  of  public  assembly,  50,  has  no  basis  in  science.  It  is  an  irrational  number  selected  by 
a  consensus  committee  to  establish  a  benchmark  for  code  compliance. 
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similar  occupancies  (Jonic,  2013).  Nine  fire  fighters  in  Charleston,  South  Carolina  died 
on  June  18,  2007  in  a  single-story  furniture  store.  The  most  recent  editions  of  the  model 
building  codes  have  been  amended  to  include  requirements  for  automatic  sprinklers  in 
retail  stores  where  highly  combustible  upholstered  furniture  is  sold  (International  Code 
Council,  2012).  While  each  of  these  events  was  tragic,  the  code  changes  they  spawned 
were  based  more  on  emotional  response  to  the  incidents  than  a  comprehensive  analysis  of 
the  fire  and  life  safety  threat  that  all  high-rise  buildings,  nightclubs,  or  furniture  stores 
pose. 

It  is  important  to  acknowledge  that  the  national  model  building  codes  establish 
only  minimum  life  safety  and  fire  protection  standards.  No  prohibition  occurs  that 
prevents  an  architect,  designer,  owner  or  tenant  from  providing  additional  features  that 
may  enhance  safety  and  security  beyond  the  minimums  specified  in  the  code.  As  a  simple 
example,  the  model  building  codes  require  office  buildings  more  than  three  stories  high 
to  have  two  distinct  egress  paths  via  stairways.  With  some  unique  exceptions,  these  stairs 
are  required  to  be  physically  separate.  Thus,  if  one  stairway  were  compromised, 
occupants  should  expect  to  have  an  alternate  means  of  escape  via  the  other  stairway. 
Nothing  in  the  building  codes  would  prevent  the  architect  or  tenant  from  providing 
additional  stairways  for  safety  or  convenience;  those  elective  features  could  be  added  at 
the  owner’s  discretion. 

In  addition  to  their  generic  scope,  prescriptive  codes  and  designs  are  criticized  for 
discouraging  innovation,  being  inflexible  to  evolving  changes  in  methods  and  materials, 
and  unnecessarily  increasing  design  and  construction  costs.  A  common  criticism  of 
building  codes  is  that  they  stifle  innovation  in  both  materials  and  design.  In  the  1970s, 
several  independent  and  government-sponsored  reports  were  critical  of  both  building 
codes  and  how  they  were  enforced.  Gauchat  and  Shodek  (1977)  found  that  “by 
prescribing  specific  methods  and  materials  of  construction  specification  codes  may  also 
protect  the  interest  of  certain  participant  groups  in  the  building  industry  rather  than  act  in 
the  interest  of  all.  Union  and  labor  groups  clearly  have  a  vested  interest  in  some  items  in 
a  typical  specification  code”  (p.  22).  Richards  (1977)  was  critical  of  the  role-building 
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product  developers  played  in  construction  regulations.  He  claimed  “innovation  in 
building  codes  and  standards  too  often  is  implemented  only  after  producer  monopolies 
are  assured  no  damage  will  be  done  to  their  vested  interest,  and  secondly,  that  they  will 
benefit  from  any  change”  (p.  280).  Oster  and  Quigley  (1977),  however,  found  that  greater 
detenninants  affecting  the  diffusion  of  constructional  innovation  were  the  educational 
level  of  the  chief  building  official,  the  extent  of  trade  unionism  in  the  study  area,  and  the 
relative  size  of  construction  companies. 

Also,  prescriptive  designs  and  codes  are  blamed  for  increasing  construction  costs 
when  their  requirements  might  exceed  the  nature  of  the  threat.  In  one  example  cited  by  a 
leading  industrial  risk  assurance  firm,  the  “codes  can  be  too  restrictive,  causing  facilities 
unnecessary  expense.  For  example,  the  codes  could  call  for  the  construction  of  a  3-ft 
(0.9  m)  dike  around  a  flammable  liquids  tank  when  a  one-ft  (0.3  m)  containment  would 
suffice  [to  contain  any  spills  or  leaks  from  the  tank]”  (“Building  Codes,”  1994,  p.  8). 
Prescriptive  codes  are  full  of  similar  examples  where  accreted  requirements  added  over 
time  increase  construction  and  maintenance  costs  without  concomitant  measurable  safety 
improvements.  Likewise,  prescriptive  designs  and  codes  have  long  been  recognized  as 
not  flexible  enough  to  address  all  situations  or  threats  (Frantzich,  1998).  Not  all  hazards 
and  their  controls  fit  well  into  the  traditional  prescriptive  model.  When  the  semi¬ 
conductor  fabrication  industry  evolved  in  the  early  1980s,  its  chemical  hazards  and 
operational  processes  were  so  different  from  anything  previously  encountered  that  no  one 
could  figure  out  how  to  apply  traditional  building  and  fire  code  requirements.  Entire  new 
provisions  had  to  be  developed  to  address  this  new  technology. 

Perhaps  most  significant,  prescriptive  codes  have  no  means  to  evaluate  the 
success  or  failure  of  compliance  with  their  requirements.  Torero  (2006)  found  that 
despite  the  technical  origin  and  empirical  basis  of  past  prescriptive  codes,  they  are 
incapable  of  assessing  the  perfonnance  of  a  building  under  fire  conditions;  instead,  they 
simply  assume  adequate  safety  levels  are  met.  New  York’s  World  Trade  Center  complex 
was  a  classic  example  of  prescriptive  design  that  proved  vulnerable  to  an  unanticipated 
and  evolving  threat.  Both  towers  were  designed  to  withstand  the  routine  rigors  of 
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weather,  vibration,  earthquake,  and  other  loads.  They  were  even  designed  to  survive  the 
impact  of  an  airplane,  which  they  did  on  September  11,  2001. 63  According  to  Eagar  and 
Musso  (2001),  “the  early  news  reports  noted  how  well  the  towers  withstood  the  initial 
impact  of  the  aircraft;  however,  when  one  recognizes  that  the  buildings  had  more  than 
1 ,000  times  the  mass  of  the  aircraft  and  had  been  designed  to  resist  steady  wind  loads  of 
30  times  the  weight  of  the  aircraft,  this  ability  to  withstand  the  initial  impact  is  hardly 
surprising”  (p.  8).  More  significant  was  the  deflagration  of  nearly  24,000  gallons 
(90,850  L)  of  jet  fuel  with  the  ensuing  fire  among  the  building’s  nonnal  contents  that  was 
the  principal  cause  of  the  collapse  (Eagar  &  Musso,  2001).  The  prescriptive  design  and 
engineering  standards  in  place  when  the  World  Trade  Center  was  built  had  not 
anticipated  a  fire  of  this  magnitude.64  Furthermore,  an  early  post-incident  analysis  of  the 
World  Trade  Center  event  by  the  Federal  Emergency  Management  Agency  reinforced 
Eagar  and  Musso ’s  findings  and  added  that  many  of  the  “structural  and  fire  protection 
features  of  the  design  and  construction  were  found  to  be  superior  to  the  minimum  code 
requirements”  (Federal  Emergency  Management  Agency,  2002b,  p.  2).  Thus,  despite 
evident  compliance  with  prescriptive  building  code  requirements,  no  way  existed  to 
predict  these  buildings’  perfonnance  when  attacked  by  fire  in  combination  with  the 
aircraft  impact. 

In  their  article,  Risk  Perception  in  Performance-Based  Building  Design  and 
Applications  to  Terrorism-Resistant  Design,  Thompson  and  Bank  (2007)  argued  that: 

As  terrorism  represents  a  constantly  changing  design  challenge,  it  seems 
unlikely  that  prescriptive  code  requirements  will  be  fully  effective  in 
countering  this  hazard.  Codes  are  not  intended  to  be  static  documents,  but 
must  evolve  as  new  information  becomes  available  or  new  situations  arise. 

PBD  is  well  suited  for  design  issues  that  deal  with  evolving,  “cutting- 


63  Additionally,  the  north  tower  survived  a  subterranean  truck  bombing  in  1993  that  attempted  to 
topple  it  onto  the  south  tower. 

64  In  an  eerily  prescient  comment,  a  U.S.  Department  of  Housing  and  Urban  Development  building 
regulation  report  said,  “On  July  28,  1945,  an  Army  bomber  lost  in  the  fog  literally  flew  into  the  side  of  the 
Empire  State  Building.  Though  14  died  from  the  crash  and  ensuing  fire,  the  building  was  essentially 
undamaged.  Not  that  the  World  Trade  Center  would  collapse  under  a  similar  stress,  but  the  factor  of  safety 
gained  through  the  inherent  overdesign  of  earlier  construction  methods  and  materials  is  lacking"  (Building 
Technology,  1981,  p.  40). 
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edge”  concepts.  PBD  is  also  well-suited  to  use  in  a  target-specific  hazard 
environment,  as  appropriate  performance  objectives  can  be  chosen 
according  to  the  hazard  level  of  individual  buildings.  Thus,  PBD  seems  a 
natural  approach  for  development  of  an  adaptable  terrorism-resistant 
design  methodology,  (pp.  66-67) 


B.  PERFORMANCE-BASED  DESIGNS  AND  CODES 

One  of  the  key  opportunities  for  protecting  lives  and  increasing  resilience  in  the 
built  environment  exists  in  the  adoption  and  application  of  building  designs  and  codes 
that  can  be  customized  to  address  specific  threats.  Prescriptive  codes  provide  a  generic 
framework,  but  cannot  address  all  natural  or  manmade  threats.  Code  compliance  alone  is 
no  assurance  that  a  building  will  successfully  resist  fire  damage  caused  by  an  accident  or 
a  malicious  attack.  Performance-based  designs  and  codes  are  outcome-driven,  the  desired 
end  state  is  developed  and  alternative  design  solutions  are  offered  to  meet  it. 

No  universal  definition  exists  for  perfonnance-based  design.  As  have  many 
others,  Gross  (1996)  cited  the  ancient  Babylonian  Code  of  King  Hammurabi  who  decreed 
that  if  a  builder  constructed  a  house  and  the  house  fell  and  killed  the  occupant,  the  builder 
must  be  put  to  death,  as  the  first  perfonnance-based  requirement.  However,  in  more 
contemporaneous  terms,  Gross  added  that  the  perfonnance  concept  was  often  interpreted 
differently  among  different  users.  To  some,  he  wrote: 

it  is  a  concept  of  qualitative  aspirations  for  buildings  without  a  systematic 
methodology  for  analysis  and  verification.  For  others,  [it]  is  a  concept 
which  requires  quantitative  analysis  and  rigorous  evaluation  that  at  times 
discourages  those  who  wish  to  use  the  concept  when  these  tools  are  not 
available.  (Gross,  1996,  p.  5) 

For  the  purpose  of  this  study,  however,  a  single  working  definition  is  required.  The 
following  description  is  borrowed  from  the  SFPE  (National  Fire  Protection  Association 
&  Society  of  Fire  Protection  Engineers,  2000): 
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performance-based  design  is  an  engineering  approach  to  building  design 
based  on  established  safety  goals  and  objectives;  deterministic  and 
probabilistic  analysis  of  threat  scenarios  and  quantitative  assessment  of 
design  alternatives  against  the  goals  and  objectives  using  engineering 
tools,  methodologies  and  perfonnance  criteria,  (p.  9) 

Detenninistic  analysis  is  a  method  of  evaluation  that  presumes  the  net  result  will 
always  produce  the  same  outcome  or  prediction  for  a  given  set  of  identified  conditions. 
Probabilistic  analysis,  on  the  other  hand,  considers  the  likelihood  of  different  scenarios 
and  the  conditions  that  describe  them  to  draw  conclusions  on  potential  losses  and 
consequences  (National  Fire  Protection  Association  &  Society  of  Fire  Protection 
Engineers,  2000).  Perfonnance-based  solutions  are  intended  to  establish  measurable 
tenant  use  and  occupancy  perfonnance  objectives — not  arbitrary  rules — and  provide 
scientific  or  engineered  design  solutions  to  meet  them.  Alvarez  and  Meacham  (2010) 
found  that  one  of  the  main  advantages  of  performance-based  design — particularly  for  fire 
safety — is  that  it  enables  the  designer  to  propose  and  evaluate  options  equivalent  to  other 
code  requirements,  but  “without  imposing  undesired  constraints  on  aspects  of  building 
design,  such  as  design  flexibility,  innovation,  or  maximization  of  cost/benefit  ratio”  (p. 
2). 

Perfonnance-based  designs  are  not  limited  to  fire  safety  solutions  and  they  can  be 
employed  to  address  a  broad  range  of  homeland  security  issues;  the  key  is  for  those  who 
have  an  interest  in  the  building’s  design  and  use  (the  “stakeholders”)  to  quantify  the 
range  and  scale  of  potential  threats  to  the  building  or  facility.  One  perfonnance  objective, 
for  example,  may  be  the  occupant’s  desire  for  reliable  continuity  of  operations;  therefore, 
the  design  solutions  are  focused  on  maintaining  operational  reliability.  This  objective 
may  be  particularly  important  to  government  agencies.  Another  perfonnance  objective 
may  be  to  create  a  large  open-area  building  without  fire  resistive  construction  or  built-in 
fire  protection  systems  to  permit  special  research  and  development  projects.  Prescriptive 
codes  may  not  permit  a  project  of  this  scale.  The  design  flexibility  to  address  specific 
infrastructure  protection  needs  is  not  intrinsic  to  prescriptive  designs  or  codes.  For 
example,  due  to  their  size  and  character,  most  of  the  unique  mega-hotel/casino  projects 
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built  in  Clark  County,  Nevada,  in  the  last  two  decades,  employed  some  combination  of 
perfonnance-based  design  elements  because  they  could  not  comply  with  the  limitations 
of  prescriptive  methods.  In  perfonnance-based  design,  each  structure  essentially  is 
constructed  to  its  own  unique  building  code. 

To  provide  a  legal  framework  for  code  enforcement  authorities  to  accept  and 
evaluate  proposed  perfonnance-based  designs,  the  ICC  in  2001  published  the  ICC 
Performance  Code  for  Buildings  and  Facilities.  The  code  is  intended  to  provide  for  “an 
environment  free  of  unreasonable  risk  of  death  and  injury  from  fires”  and  “an  acceptable 
level  of  life  safety  and  property  protection  from  the  hazards  of  fire,  explosion  or 
dangerous  conditions  in  all  facilities,  equipment  and  processes”  (International  Code 
Council,  2009).  By  2011,  11  states  and  54  local  jurisdictions  in  the  United  States  had 
adopted  the  ICC  Performance  Code  for  Buildings  and  Facilities  (J.  Gibson,  personal 
communication,  May  9,  2011).  Despite  this  effort,  in  the  United  States,  Hurley  (2008) 
found  that  its  use  has  not  been  widely  accepted,  “anecdotal  evidence  suggests  that 
performance-based  design  is  used  on  five  to  10  percent  of  building  design  projects”  (p. 
2). 

The  ICC  Performance  Code  for  Buildings  and  Facilities  (the  Code)  provides 
design  guidance  in  two  critical  areas,  descriptions  of  appropriate  “performance  groups” 
for  buildings  and  facilities,  and  maximum  levels  of  damage  that  can  be  tolerated  based  on 
the  magnitude  of  specific  events.  The  relationship  between  perfonnance  groups  and  event 
magnitude  is  explained  in  subsequent  text.  First,  Table  16  summarizes  the  four 
perfonnance  group  classifications  that  rate  buildings  and  facilities  based  on  their 
significance  to  the  community  in  which  they  are  located. 
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Table  16.  ICC  Performance  Code  for  Buildings  and  Facilities  Performance  Group 
Classifications  (After:  International  Code  Council,  2001) 


Performance 

Group 

Use  or  Occupancy  for  Specific  Buildings  or  Facilities 

I 

Agricultural  facilities,  temporary  facilities  and  minor  storage 
facilities. 

II 

All  buildings  and  facilities  except  those  listed  in  Perfonnance 

Groups  I,  III  or  IV. 

Buildings  and  facilities  that  represent  a  substantial  hazard  to  human 
life  in  the  event  of  a  failure,  including,  but  not  limited  to: 

1. 

Buildings  or  facilities  in  which  more  than  300  people 
congregate  in  one  area. 

III 

2. 

Elementary  schools,  secondary  schools  or  day  care  facilities 
with  a  capacity  more  than  250. 

3. 

Health  care  facilities  with  a  capacity  of  more  than  50,  but 
lacking  surgical  or  emergency  treatment  capacity. 

4. 

Jails  and  detention  facilities. 

5. 

Power  generation,  water  treatment,  or  other  public  facilities  not 
included  in  Performance  Group  IV. 

Buildings  and  facilities  designated  as  essential  facilities,  including 
but  not  limited  to: 

1. 

Hospitals  and  other  health  care  facilities  with  surgical  or 
emergency  treatment  capacity. 

2. 

Fire,  rescue,  and  police  stations  and  emergency  vehicle 
garages. 

IV 

3. 

Designated  emergency  preparedness,  communication  and 
operations  centers,  and  other  facilities  required  for  emergency 
response. 

4. 

Buildings  and  facilities  having  critical  national  defense 
functions. 

5. 

Essential  utilities  for  back-up  power  generation  and  water 
distribution  for  fire  suppression. 
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Although  federal  government  facilities  are  exempt  from  locally  adopted  building 
and  fire  codes,  they  most  nearly  represent  occupancies  described  in  performance  groups 
III  and  IV.  These  performance  group  descriptors  might  be  used  to  provide  the  ISC 
additional  data  for  their  design  considerations. 

Since  building  and  fire  codes  represent  a  community’s  minimum  standards  for  the 
risk  it  is  willing  to  accept,  the  Code  includes  characteristics  of  the  maximum  level  of 
damage  to  be  tolerated,  which  is  the  second  element  in  the  relationship  between 
perfonnance  groups  and  event  magnitude.  Levels  of  impact  are  characterized  as  mild, 
moderate,  high,  and  severe  depending  upon  their  effect  on  structural  damage, 
nonstructural  systems,  occupants,  hazardous  materials,  and  the  overall  extent  of  damage 
(International  Code  Council,  2001).  Third,  the  magnitude  of  events — including  natural 
and  technological  (or  manmade)  hazards — is  the  severity  of  the  consequences  of  potential 
threats  and  vulnerabilities  as  expressed  “deterministically  or  probabilistically  according 
to  the  best  current  practice  of  the  relevant  profession  as  published  in  recognized 
authoritative  documents”  (International  Code  Council,  2001,  p.  15).  Event  magnitude  is 
classified  as  small,  medium,  large,  and  very  large. 

In  combination,  the  performance  groups,  levels  of  impact,  and  event  magnitude 
define  the  Code’s  maximum  level  of  damage  that  can  be  tolerated.  Figure  4  captures 
these  criteria. 
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Figure  4.  ICC  Perfonnance  Code  for  Buildings  and  Facilities  Maximum  Tolerated 
Damage  Levels  (After:  International  Code  Council,  2001) 


Using  Figure  4,  the  maximum  tolerated  damage  level  to  a  building  having  critical 
national  defense  functions  (Performance  Group  IV)  must  be  mild  for  small,  medium,  or 
large  events,  and  only  moderate  for  very  large  or  very  rare  events. 

In  the  federal  environment,  where  its  own  construction  standards  are  applicable, 
they  permit  performance-based  design  as  an  alternative  to  the  prescriptive  methods.  The 
ISC  Physical  Security  Criteria  for  Federal  Facilities  is  a  significant  step  toward 
performance-based  fire  safe  design  in  federal  facilities  because  it  relies  on  the  tenants 
who  possess  a  stake  in  building  operations  and  safety  to  describe  their  desired  protection 
levels.  However,  this  document  addresses  only  threats  it  describes  as  “primarily 
manmade,”  and  claims  other  threats,  such  as  earthquake,  fire,  or  storms  are  beyond  the 
scope  of  the  document  and  are  addressed  in  other  applicable  construction  standards  (U.S. 
Department  of  Homeland  Security,  2010c). 
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c. 


APPLICATION  OF  PERFORMANCE-BASED  DESIGN 


The  SFPE  publishes  a  model  for  the  application  of  the  perfonnance-based  design 
process,  which  is  an  iterative  process  that  begins  when  a  project  is  proposed  and 
continues  through  completion.  Figure  5  depicts  the  SFPE  perfonnance-based  design 
model.  The  ISC  Physical  Security  Criteria  for  Federal  Facilities  standard  does  not 
address  evaluation  methods  for  the  pennanent  countenneasures  it  suggests;  thus,  this 
thesis  is  limited  to  the  first  six  steps  of  the  SFPE  model  that  may  provide  guidance  for  the 
ISC  to  develop  evaluative  criteria  for  trial  designs. 
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SFPE  Performance-Based  Design  Process  Model 
99 


Figure  5. 


The  first  step  in  the  design  process,  defining  the  project  scope,  is  important  for  the 
design  team  and  stakeholders  to  establish  fundamental  agreement  upon  what  the  project 
will  encompass.  The  composition  of  the  stakeholder  group  can  be  project-specific,  and 
can  include  the  building’s  owner,  tenant  representatives,  architects,  interior  designers, 
maintenance  personnel,  and  even  neighboring  property  owners.  In  the  Physical  Security 
for  Federal  Facilities  framework,  the  FSC  represents  a  logical  and  important  stakeholder. 
Agreement  upon  the  project  scope  is  expected  to  maximize  overall  project  success.  If,  for 
example,  the  tenant  is  expecting  a  major  overhaul  of  their  tenant  space  to  improve  the 
office  environment  for  enhanced  workflow,  but  the  design  team  is  expecting  only  to 
upgrade  fire  protection  features  and  building  services,  substantial  potential  for  conflict 
can  occur  between  the  expectations  and  the  outcome.  A  well-defined  and  documented 
project  scoping  exercise  reduces  the  likelihood  of  conflict. 

In  the  SFPE  model’s  second  step,  a  stakeholder  group  establishes  project  goals. 
These  goals  generally  are  not  measurable,  but  describe  the  project  team’s  desired 
outcomes.  SFPE  (National  Fire  Protection  Association  &  Society  of  Fire  Protection 
Engineers,  2000)  includes  the  following  model  goals  for  fire  safety  that  are  highly 
applicable  to  federal  properties: 

•  Provide  life  safety  for  the  public,  building  occupants,  and  emergency 
responders.  Minimize  fire-related  injuries,  and  prevent  undue  loss  of  life. 

•  Protect  property.  Minimize  damage  to  property  and  cultural  resources 
from  fire.  Protect  building,  contents,  and  historical  features  from  fire  and 
exposure  to  and  from  adjacent  buildings. 

•  Provide  continuity  of  operations.  Protect  the  organization’s  ongoing 
mission,  production,  or  operating  capability.  Minimize  undue  loss  of 
operations  and  business-related  revenue  due  to  fire-related  damage. 

•  Limit  the  environmental  impact  of  the  fire.  Protect  air  and  water  quality  by 
minimizing  emissions  and  controlling  runoff  (p.  27). 

In  the  overall  project  context,  the  number  and  scope  of  stakeholder  goals  are  not 
limited,  and  may  include  such  things  as  minimizing  construction  costs,  maximizing 
design  flexibility,  maintaining  neighborhood  character,  employing  unique  architectural 
features  or  materials,  or  improving  pedestrian  flow. 
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Since  the  goals  are  non-specific,  eventually  metrics  must  be  applied  to  detennine 
if  the  selected  design  criteria  are  appropriate.  Refining  the  goals  into  stakeholder  design 
objectives  is  the  next  step.  Stakeholder  objectives  provide  more  detail  than  the  goals,  and 
may  be  described  in  terms  of  maximum  acceptable  or  sustainable  loss,  or  the  tolerated 
levels  of  risk.  In  some  instances,  the  stakeholder  objectives  may  be  clearly  articulated. 
For  example,  in  the  goal  category  of  protecting  property,  the  objective  might  be  to 
confine  a  fire  to  the  room  where  it  starts.  Given  this  level  of  tolerated  loss,  the  design 
team  can  begin  to  develop  fire  protection  and  construction  strategies  intended  to  prevent 
damage  from  exceeding  the  specified  level. 

Next,  quantifiable  performance  criteria  are  developed  that  eventually  are  used  as 
benchmarks  against  which  various  designs  can  be  compared.  The  performance  criteria  are 
related  to,  but  more  specific,  than  the  stakeholder  design  objectives,  and  include 
threshold  values,  ranges  of  threshold  values,  or  distributions  of  results  from  the  sample 
fire  scenarios  that  will  be  employed  (National  Fire  Protection  Association  &  Society  of 
Fire  Protection  Engineers,  2000).  If  the  design  objective  is  to  confine  a  fire  to  the  room  of 
origin,  one  measurable  performance  criteria  might  be  that  the  temperature  inside  the 
room  does  not  exceed  a  certain  threshold  (e.g.,  1,1 12°F  [6,000°C]),  and  the  temperatures 
in  adjacent  spaces  remain  at  levels  that  will  enable  humans  to  survive  (e.g.,  135°F 
[57°C]).  These  perfonnance  criteria  are  used  to  provide  design  guidance  for  safe  egress 
times,  desired  fire  control,  smoke  management,  or  fire  protection  system  perfonnance. 
While  the  number  of  performance  criteria  is  limited  only  by  the  stakeholders  and  design 
team,  it  is  important  to  note  that  as  more  criteria  are  added,  the  design  solutions — or  what 
the  Physical  Security  for  Federal  Facilities  standard  might  call  permanent 
countermeasures  [emphasis  added] — become  more  complex.  Furthennore,  it  is  essential 
to  acknowledge,  “it  is  impossible  to  achieve  a  completely  hazard-  or  risk-free 
environment.  Additionally,  as  the  level  of  hazard  or  risk  decreases,  the  costs  associated 
with  those  decreasing  levels  of  risk  typically  increase”  (National  Fire  Protection 
Association  &  Society  of  Fire  Protection  Engineers,  2000,  p.  36).  For  stakeholders  and 
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the  design  team,  an  important  part  of  the  performance-based  design  process  is 
establishing  realistic  perfonnance  criteria  that  can  be  achieved  within  both  the  project 
scope  and  budget. 

D.  DESIGN  FIRE  SCENARIOS 

A  critical  component  of  performance-based  design  for  fire  safety  is  the 
development  of  rational  lire  scenarios  that  could  occur  in  the  building  or  facility  under 
study.  The  design  fire  scenarios  are  developed  and  evaluated — often  using  fire-modeling 
techniques — to  assess  the  effectiveness  of  proposed  design  solutions.  According  to 
Hurley  and  Quiter  (2003),  the  design  lire  scenarios  must  be  based  on  the  reality  of 
potential  lire  effects  from  the  nature  of  the  occupancy,  the  fuel  load,  potential  changes  in 
the  property,  the  presence  of  fire  detection  and  protection  systems,  and  the  purpose  for 
which  the  design  fire  is  being  developed.  The  lack  of  a  clearly  defined  and  quantifiable 
design  lire  is  the  main  deficiency  of  the  DBT  arson  scenario  used  in  the  Physical  Security 
for  Federal  Facilities  standard  since  the  following  conditions  are  not  quantified  “an 
adversary  places  an  improvised  incendiary  device  (IID)  containing  an  accelerant  and 
utilizing  a  delay  mechanism  adjacent  to  a  facility,  but  outside  the  view  of  security 
countermeasures”  (U.S.  Department  of  Homeland  Security,  2010c).  The  IID  size  and 
accelerant  characteristics  are  not  described  and  its  distance  from  the  facility65  is  not 
specified.  These  factors  are  important  in  developing  permanent  countenneasures. 
Without  explicit  threat  criteria,  it  is  impossible  to  evaluate  whether  proposed  pennanent 
countenneasures  can  be  or  are  effective.  (It  is  not  clear  from  the  DBT  what  significance 
the  “delay  mechanism”  or  “outside  the  view  of  security  countermeasures”  play  in  the  fire 
consequence  scenario  unless  it  is  anticipated  that  a  delayed  ignition  or  early  detection  by 
surveillance  would  enable  an  intervention  before  the  IID  has  a  chance  to  ignite.  These 
elements  are  outside  the  scope  this  study). 


65  Likewise,  the  facility’s  construction  characteristics  (e.g.,  combustible,  non-combustible,  or  fire 
resistive)  are  important  to  determine  the  potential  consequences  of  the  IID. 
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The  quantification  of  design  fire  scenarios  is  a  two-step  process.  First,  a  design 
fire  curve  is  developed  that  represents  the  four  phases  of  a  fire66  that  might  occur  in  the 
studied  project:  ignition,  growth,  full  development,  and  decay  (Hurley  &  Quiter,  2003). 
In  its  simplest  portrayal,  a  design  fire  curve  characterizes  the  evolving  temperature 
behavior  of  a  fire  in  a  compartment.  The  ambient  room  temperature  is  not  significantly 
altered  at  the  outset  by  the  ignition  of  a  fuel,  but  as  the  fire  grows  and  reaches  full  energy 
output,  the  temperature  rises  until  it  reaches  its  maximum  based  on  available  fuel  and 
ventilation.  As  the  fuel  and  oxygen  are  consumed,  the  fire  eventually  enters  a  decaying 
state  until  it  loses  all  energy  or  is  extinguished.  The  second  part  of  the  fire  scenario 
quantification  exercise  is  predicting  the  potential  fire  effects  from  the  results  of  the  fire 
models.  These  effects  may  include  smoke  and  fire  spread  beyond  the  room  of  origin,  fire 
growth  to  structural  collapse,  occupant  tenability,  or  the  operation  of  fire  protection 
systems. 

Since  design  fire  scenarios  are  expected  to  represent  fires  that  likely  could  occur 
in  a  building  or  facility,  the  fire  protection  engineering  community  over  time  has 
developed  a  variety  of  standardized  scenarios  against  which  design  professionals  can  test 
their  proposed  life  safety  and  fire  protection  design  solutions.  Table  17,  which  represents 
design  fire  scenarios  created  for  the  National  Fire  Protection  Association’s  Life  Safety 
Code,  is  repeated  to  illustrate  some  sample  design  fire  scenarios. 


66  Fire  behavior  is  explored  in  greater  detail  in  Chapter  IV. 
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Table  17.  Design  Fire  Scenarios  from  NFPA  101,  Life  Safety  Code  (After:  National 

Fire  Protection  Association,  2012) 


Scenario 

Elements 

1 

Occupancy-specific  fire  representative  of  a  typical  fire  in  the  occupancy. 

Explicitly  accounts  for  occupant  activities,  number,  and  location,  room  size, 
furnishings  and  contents,  fuel  properties  and  ignition  sources,  ventilation 
conditions  and  identification  of  the  first  item  ignited  and  its  location. 

2 

Ultra-fast  developing  fire,  in  the  primary  means  of  egress,  with  interior  doors 
open  at  the  start  of  the  fire. 

3 

Fire  starting  in  a  normally  unoccupied  room,  potentially  endangering  a  large 
number  of  occupants  in  a  large  room. 

4 

Fire  originating  in  a  concealed  wall  or  ceiling  space  adjacent  to  a  large  occupied 
room. 

5 

A  slowly  developing  fire,  shielded  from  fire  protection  systems,  in  proximity  to 
a  high  occupancy  area. 

6 

The  most  severe  fire  resulting  from  the  largest  possible  fuel  load  characteristic 
of  the  nomial  operation  of  the  building. 

7 

An  outside  exposure  fire. 

8 

Fire  originating  in  ordinary  combustibles  in  a  room  or  area  with  each  passive  or 
active  fire  protection  system  independently  rendered  ineffective. 

While  these  scenarios  are  included  in  a  nationally  recognized  model  safety  code, 
they  are  not  the  only  design  fire  scenarios  that  might  exist.  It  is  incumbent  upon  the 
stakeholders  and  design  team  to  reach  a  consensus  on  the  variety  and  scale  of  potential 
design  lire  scenarios  that  could  occur  in  a  specific  project  under  consideration.  The  range 
of  potential  events  from  the  routine  to  the  farfetched  may  have  to  be  considered,  which  is 
what  Ripley  (2009)  called  “the  unthinkable.”  Hurley  and  Quiter  reported  that  some  risk 
evaluations  must  be  used  when  developing  fire  scenarios:  “though  a  fire  may  be 
technically  plausible,  if  it  is  extremely  unlikely,  that  fire  may  not  be  necessary  to  include 
as  a  design  fire”  (2003,  p.  3-151).  Several  design  fire  scenarios  are  employed  in  this 
thesis  to  illustrate  whether  the  arson  threat  scenario  in  the  DBT  can  be  quantified  for 
selecting  pennanent  countenneasures. 
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As  design  fire  scenarios  are  developed,  the  design  team  must  consider  that  the 
nature  and  use  of  the  occupancy  may  change  over  time.  The  initial  project  assumptions 
may  not  remain  the  same  over  the  life  cycle  of  the  building  or  facility  that  could  affect 
the  original  design  criteria.  For  example,  if  conditions  (e.g.,  spatial  configuration,  fuel 
load,  fuel  array)  change,  the  fire  protection  features  may  have  to  change  to  match  the  new 
arrangement  because  the  original  design  strategies  may  no  longer  perform  as  expected. 
While  this  situation  is  more  problematic  in  properties  under  private  ownership 
susceptible  to  market  pressures  of  sale  or  lease  and  change  of  use,  it  is  a  legitimate 
concern  in  public  facilities  as  well.  Developing  the  range  of  potential  changes  is  known 
as  establishing  bounding  conditions  (Hurley  &  Quiter,  2003)  and  will  be  explored  in 
further  detail  in  the  section  on  evaluating  permanent  countermeasures  through  risk 
analysis. 

The  potential  breadth  of  design  fires  must  be  considered  as  well.  Note  that  in 
Table  17,  all  the  design  fire  scenarios  begin  with  a  single  ignition  event.  These  scenarios 
do  not  consider  fire’s  influence  as  a  consequence  of  another  significant  event  as 
evidenced  by  the  2001  World  Trade  Center  aircraft  attacks.  Writing  in  Extreme  Event 
Mitigation  in  Buildings,  Custer,  Marrion,  and  Johann  (in  Meacham  &  Johann,  2006) 
noted  that  for  fire  safety  planning  and  design,  it  is  important  to  include  fires  resulting 
from  extreme  events,  as  well  as  severe  events  that  might  occur  as  a  result  of  a  fire. 
Stakeholders  should  be  encouraged  to  think  freely  about  potential  threats  regardless  of 
their  immediate  plausibility.  Multiple  IID  attacks,  a  gasoline  tanker  driven  into  a 
building,  or  a  liquefied  petroleum  gas  delivery  vehicle  detonated  adjacent  to  a  structure 
may  be  the  sorts  of  extreme  events  that  result  in  simultaneous  significant  fires  in  multiple 
locations.  Fire  safety  design  in  the  current  prescriptive  environment  and  recommended 
design  fire  scenarios  are  ill  suited  to  protect  against  these  catastrophic  threats.  Custer, 
Marrion,  and  Johann  (2006)  close  their  article  by  writing: 

Evaluating  candidate  [design]  strategies  requires  development  of  realistic 
design  fire  scenarios  that  encompass  worst-case  conditions  and  rational 
decision-making  techniques  based  on  the  risks  and  consequences  of  those 
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scenarios.  This  process  is  critical,  because  it  can  help  ensure  that  buildings 
are  designed  with  attention  to  the  actual  fire  hazards  they  may  encounter 
in  mind.  (p.  266) 


E.  TRIAL  DESIGNS 

Once  the  design  team  has  agreed  upon  perfonnance  criteria  and  a  representative 
sample  of  design  fire  scenarios,  the  means  that  might  be  employed  to  mitigate  the  fire 
impacts  are  developed  through  trial  building  and  fire  protection  system  designs67  (see 
Step  6  in  the  SFPE  design  model,  Figure  5).  The  trial  designs  may  include  features  from 
one  or  more  components  or  sub-systems  that  comprise  the  building  or  facility’s  physical 
or  operational  characteristics,  as  well  as  the  physical  features  of  fire  resistant 
construction,  the  use  of  automatic  fire  detection  and  suppression  systems,  and  the 
operational  traits  of  fire  behavior,  smoke  spread,  and  occupant  behavior  and  egress 
(National  Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers,  2000).  The 
trial  designs  give  the  design  team  the  opportunity  to  identify  and  evaluate  a  variety  of 
solutions  against  the  performance  criteria  before  committing  to  a  final  design.  If  the  trial 
designs  perform  within  the  prescribed  criteria  and  design  fires,  they  are  considered  to  be 
acceptable  designs.  This  approach  gives  the  design  team  maximum  flexibility  in  materials 
and  design  while  not  being  bound  to  the  restrictions  of  a  prescriptive  set  of  regulations, 
such  as  those  outlined  in  the  DBT  . 

F.  EVALUATING  TRIAL  DESIGNS  AND  PERMANENT 

COUNTERMEASURES 

Unlike  prescriptive  designs  and  codes,  perfonnance-based  design  requires  critical 
evaluation  to  compare  expected  results  to  the  initial  design  objectives  and  performance 
criteria  to  satisfy  the  stakeholders.  While  the  concept  of  building  “safety”  is  subjective 
and  lacks  dimension,  according  to  Frantzich  (1998),  it  can  be  evaluated  by  comparing  the 


67  Within  the  context  of  the  Physical  Security  for  Federal  Facilities  standard,  the  list  of  permanent 
countermeasures  is  the  primary  menu  of  solutions  from  which  federal  Facility  Safety  Committees  (FSC) 
and  design  teams  select  to  satisfy  the  scenarios  in  the  DBT  . 
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proposed  design  with  accepted  solutions  or  with  specified  tolerable  levels  of  risk. 
“Comparing  the  design  solution  with  acceptable  solutions  can  be  performed  on  three 
levels: 

•  Simple  handbook  solutions,  i.e.  using  prescriptive  regulations. 

•  Calculation  on  sublevel,  for  example,  evaluating  escape  time 
margin. 

•  Evaluation  on  system  level,  i.e.,  perfonning  a  quantitative  risk 
analysis  (QRA).”  (pp.  314-315) 

Perfonnance-based  designs  often  employ  design,  construction,  or  material  options 
unique,  new,  or  untested  in  the  traditional  regulatory  environment.  This  evaluation 
provides  stakeholders,  the  design  team,  and  code  enforcement  officials  a  level  of 
confidence  in  the  proposed  design.  One  cannot  simply  argue  the  design  “meets  the  code,” 
but  must  show  that  one  or  more  of  the  proposed  designs  will  perfonn  in  accordance  with 
the  criteria  specified  by  the  stakeholders.  The  design  professional  accomplishes  the 
analysis  through  a  variety  of  risk  analysis  techniques  intended  to  enhance  reliability68  and 
reduce  uncertainty.  The  Physical  Security  for  Federal  Facilities  standard  describes  risk  as 
“a  function  of  the  values  of  threat,  consequence  and  vulnerability.  The  objective  of  risk 
management  is  to  create  a  level  of  protection  that  mitigates  vulnerabilities  to  threats  and 
their  potential  consequences,  thereby  reducing  risk  to  an  acceptable  level”  (p.  20)  and  the 
Facility  Security  Committee  is  responsible  for  determining  and  accepting  risk  based  on 
the  results  of  the  standard’s  evaluation  process  (Figure  3). 

Frantzich  (1998)  identified  three  methods  of  risk  analysis  developed  by  the 
International  Electrotechnical  Commission  in  its  International  Standard  603  00-3 -9: 69 
qualitative,  semi-quantitative,  and  quantitative.  The  first,  qualitative,  is  used  to  identify 


68  In  this  context,  “reliability  measures  whether  a  design  or  system  will  function  as  designed  or 
intended"1  (National  Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers,  2000,  p.  89). 

69  The  standard,  entitled  “Dependability  management-Part  3:  Application  Guide-Section  9:  Risk 
Analysis  of  Technological  Systems”  was  withdrawn  by  the  International  Electrotechnical  Commission  on 
March  4,  2011. 
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extreme  hazardous  events  without  ranking  them  to  any  particular  degree  of  hazard. 
Frantzich  recommended  qualitative  methods  be  used  as  a  screening  method  in  a 
preliminary  risk  analysis. 

Second,  semi-quantitative  risk  analysis  methods  are  used  to  determine  a  rank 
ordering  of  unwanted  events.  Hazards  are  assigned  a  point  value,  and  then  ranked 
according  to  some  standardized  scoring  system,  such  as  that  used  in  NFPA  101  A, 
Manual  on  Alternative  Approaches  to  Life  Safety.  In  this  method,  that  Frantzich  called 
indexing,  point  scheme,  or  numerical  grading,  recognized  hazards  are  assessed  a 
numerical  value,  and  the  sum  of  the  identified  problems  detennines  the  overall  risk. 
Finally,  in  quantitative  risk  analysis,  either  a  probabilistic  or  detenninistic  approach  is 
used  to  consider  all  the  variables  that  might  influence  the  outcome  of  a  fire.  According  to 
the  SFPE  (National  Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers, 
2000),  deterministic  analysis  is  a  method  of  evaluation  that  presumes  for  a  given  set  of 
identified  conditions;  the  net  result  will  always  produce  the  same  outcome  or  prediction. 
Probabilistic  analysis,  on  the  other  hand,  considers  the  likelihood  of  different  scenarios 
and  the  conditions  that  describe  them  to  draw  conclusions  on  potential  losses  and 
consequences. 

In  classical  risk  analysis,  total  risk  is  the  sum  of  the  products  of  all  events  times 
their  consequences.  All  the  anticipated  design  fire  scenarios  and  their  consequences  (e.g., 
injuries,  deaths,  extent  of  property  damage,  business,  or  service  interruption)  are 
considered  against  the  potential  frequency  of  their  occurrence.  Any  elements  that  might 
influence  fire  outcomes — such  as  inoperable  fire  protection  systems  or  compromised  fire 
resistive  construction  features — are  factored  into  the  analysis.  Historical  data  on  the 
number  of  fires  in  similar  properties  are  used  to  estimate  the  frequency  of  events.  The 
number  of  variables  that  must  be  computed  is  dependent  upon  the  project  scale  and  the 
stakeholders’  demand  for  accurate  analysis.  As  more  potential  scenarios  are  evaluated, 
the  accuracy  of  the  analysis  increases.  Given  the  small  data  set  for  arson  fires  in  federal 
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properties  compared  to  the  substantial  amount  of  federally  owned  or  leased  resources,  the 
use  of  classical  risk  analysis  to  evaluate  design  fire  perfonnance  criteria  may 
underestimate  the  potential  vulnerabilities. 

Rather  than  anticipate  every  conceivable  arson  scenario  and  their  potential 
consequences  through  classical  risk  analysis,  risk  binning  analysis  can  be  employed  to 
develop  an  approximate,  quantified  risk  assessment  (National  Fire  Protection  Association 
&  Society  of  Fire  Protection  Engineers,  2000).  In  risk  binning  analysis,  the  need  to 
inventory  every  scenario  is  lessened,  and  a  greater  emphasis  is  placed  on  realistic  worst- 
case  scenarios  ranked  according  to  their  likely  occurrence.  Events  are  put  into  categories 
or  bins  to  provide  quantifiable  results.  Generally,  in  accordance  with  acceptable 
engineering  principles,  the  consequences  should  cover  95%  of  all  possible  event 
outcomes70  (National  Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers, 
2000).  The  stakeholders  must  describe  the  range  of  consequences  and  their  value.  Table 
18  provides  an  example  of  how  consequences  might  be  ranked  by  the  stakeholders. 


Table  18.  Possible  Consequence-Ranking  Criteria  (After:  National  Fire  Protection 
Association  &  Society  of  Fire  Protection  Engineers,  2000) 

Consequence  Level  Impact  on  Humans  Impact  on 

_ Property/Operations 


High  (H) 

Sudden  fatalities,  acute 
injuries,  immediately  life- 
threatening  situations, 
permanent  disabilities. 

Building  destroyed, 
operations  and  service 
delivery  temiinated. 

Moderate  (M) 

Serious  injuries,  permanent 
disabilities,  hospitalization 
required. 

Building  uninhabitable,  major 
equipment  destroyed,  delayed 
operations  functional  at 
another  location. 

70  The  95%  value  is  derived  from  two  national  consensus  engineering  standards,  the  U.S.  Guide  to  the 
Expression  of  Uncertainty  in  Measurement  from  the  American  National  Standards  Institute,  and  Test 
Uncertainty:  Instruments  and  Apparatus,  from  the  American  Society  of  Mechanical  Engineers. 
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Consequence  Level 

Impact  on  Humans 

Impact  on 

Property/Operations 

Low  (L) 

Minor  injuries,  no 
permanent  disabilities,  no 
hospitalization. 

Repairable  building  damage, 
some  operational  downtime, 
immediate  continuity  of 
operations  available  off  site. 

Minor  building  repairs 

Negligible  (N) 

Negligible  injuries. 

required,  minimal  operational 
downtime. 

In  addition  to  ranking  the  consequences,  risk  binning  analysis  requires  that  the 
potential  event  frequency  be  estimated.  In  this  method,  the  frequency  analysis  is  based  on 
the  likelihood  of  an  event  causing  damages  that  exceed  the  specified  consequence  (high, 
moderate,  low,  or  negligible),  rather  than  attempting  to  predict  the  occurrence  of  a 
specific  scenario.  Expected  frequencies  should  be  based  on  the  analysis  of  fire  incident 
data  combined  with  professional  experience.  The  SFPE  Engineering  Guide  to 
Performance-Based  Fire  Protection  borrows  from  the  DOE’s  facility  safety  analysis 
reports  for  the  probability  fonnulae  employed  in  Table  19. 


Table  19.  Sample  Frequency  Criteria  Used  for  Probability  Ranking  (After:  National 
Fire  Protection  Association  &  Society  of  Fire  Protection  Engineers,  2000) 


Frequency  Description 


Frequency  Level 
(Median  Time  to  Event) 


Description 


Anticipated,  expected 
(AE) 

>1  x  10'2/yr 
(<100  yr) 

Incidents  that  might  occur 
several  times  during  the 
lifetime  of  the  building 
(incidents  that  occur 
commonly). 

Unlikely  (Uni) 

1  x  1 0'4/yr  <f<  1  x  1 0'2/yr 
(100-10,000  yr) 

Events  not  anticipated  to 
occur  during  the  lifetime  of 
the  facility.71 

71  Natural  phenomena  of  this  probability  class  include  the  severest  earthquake,  a  100-year  flood,  or  the 
maximum  wind  gust  possible  for  the  location  where  the  building  or  facility  occurs. 
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Frequency  Description 

Frequency  Level 
(Median  Time  to  Event) 

Description 

1  x  10'6/yr  <f<  1  x  1 0"4/yr 

Events  that  probably  will  not 

Extremely  unlikely  (EU) 

(10,000-1,000,000  yr) 

occur  during  the  life  cycle  of 
the  building. 

Beyond  extremely 

<1  x  1 0'6/yr 

All  other  incidents. 

unlikely  (BEU) 

(>  1,000,000  yr) 

Once  the  consequences  and  expected  frequencies  have  been  estimated,  they  are 
converted  to  a  relative  risk  through  the  creation  of  a  consequence-frequency  matrix  as 
shown  in  Figure  6.  Each  consequence-frequency  combination  is  assigned  a  relative  risk 
level  from  the  application  of  Figure  6,  and  the  results  are  considered  bounding  risks; 
those  risks  that  the  stakeholders  determine  are  acceptable  based  on  the  prescribed 
conditions  and  cover  95%  or  more  of  all  possible  event  outcomes. 


Frequency-* 

Consequence 

1 

BEU 

<1  x  10'6/yr 

EU 

10‘4/yr  <f< 

1 0"6/yr 

U 

10'2/yr  <f<  10'4/yr 

AE 

>1  x  10'2/yr 

High 

10a 

7 

4 

1 

Moderate 

8 

5 

2 

Low 

9 

6 

3 

Negligible 

11 

12 

|  High  risk  Q  Moderate  risk  Q  Low  risk  Q  Negligible  risk 

aThe  numbers  in  the  boxes  are  for  identification  only  and  do  not  imply  a  ranking. 


Figure  6.  Sample  Risk-Ranking  Matrix  for  Risk  Binning  Analysis  (After:  National  Fire 
Protection  Association  &  Society  of  Fire  Protection  Engineers,  2000) 


As  an  example  of  how  to  apply  risk  binning  analysis  techniques,  the  stakeholders  may 
determine  that  a  worst-case  arson  fire  scenario  for  their  building  or  facility  could  result  in 
the  building  being  uninhabitable  and  that  major  equipment  would  be  destroyed,  but  that 
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continuity  of  operations  plans  (COOP)  could  be  employed  that  allow  operations  to  occur 
at  another  location.  According  to  the  Impact  on  Property/Operations  column  in  Table  18, 
the  consequences  of  such  an  event  would  be  “moderate.”  According  to  the  baseline 
profile  from  the  ISC  DBT  (2010),  the  arson  threat  to  federal  buildings  is  high  and  likely 
to  occur  during  the  life  cycle  of  the  building,  which  means  an  arson  attack  is  anticipated 
or  expected  (See  Table  19).  In  the  Risk-Ranking  Matrix  for  Risk  Binning  Analysis  (Figure 
6),  the  cell  at  the  intersection  of  the  consequence  row  and  the  frequency  column  would 
conclude  that  for  this  scenario,  an  arson  attack  is  a  high  risk  to  the  building  or  facility. 

Another  risk  assessment  tool  commonly  used  in  fire  protection  engineering  is  the 
detenninistic  analysis  approach,  in  which  the  expected  perfonnance  of  the  fire  protection 
features  is  evaluated  against  one  or  more  design  fire  scenarios  (National  Fire  Protection 
Association  &  Society  of  Fire  Protection  Engineers,  2000).  As  conditions  change  during 
a  fire  (e.g.,  ignition,  growth,  flashover,  or  maximum  heat  output),  they  are  plotted  on  a 
timeline  along  with  critical  events  that  occur  with  fire  protection  features  in  the  building 
(e.g.,  smoke  detector  operation,  sprinkler  flow,  or  vent  opening).  Since  it  is  expensive 
and  time  consuming  to  develop  full-scale  fire  tests  to  demonstrate  these  conditions  and 
assess  their  performance,  computer  fire  models  commonly  are  used  as  the  tool  to  evaluate 
fire  protection  feature  performance  of  the  trial  designs  in  the  design  fire  scenarios.  The 
trial  designs  must  satisfy  each  perfonnance  criterion  (developed  during  Step  4  of  the 
SFPE  design  model)  to  be  considered  successful.  The  number  of  variables  that  can  be 
considered  in  the  design  fire  scenario  is  significant — and  all  potential  combinations  of 
scenarios  cannot  be  predicted — therefore,  an  uncertainty  factor  or  safety  analysis  must  be 
included  in  the  analysis  so  the  stakeholders  can  detennine  the  acceptable  levels  of  risk 
that  the  trial  designs  may  mitigate. 

According  to  the  SFPE  Engineering  Guide  to  Performance-Based  Fire 
Protection,  “performance-based  fire  protection  analysis  and  design  relies  on  current 
scientific  knowledge  and  the  ability  to  perform  accurate  technical  predictions”  (p.  103). 
Like  any  discipline,  fire  protection  engineering  is  in  constant  flux  as  the  science  and 
engineering  knowledge  of  fire  behavior  and  construction  materials  evolve.  Therefore, 
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early  performance-based  designs  did  not  have  the  benefit  of  current  data  or  protocols  to 
assure  complete  accuracy,  and  today’s  designs  do  not  enjoy  the  benefit  of  future  research. 
Due  to  complexities  in  physical  and  chemical  properties,  currently,  it  is  impossible  to 
duplicate  fire  behavior  in  either  laboratory  or  real-world  conditions.  While 
accommodating  the  evolution  of  the  discipline  and  building  confidence  in  the 
perfonnance-based  approach,  it  must  be  recognized  that  these  variables  introduce 
uncertainty  into  any  analysis.  Since  the  science  and  engineering  of  fire  behavior  are  not 
fully  developed,  uncertainty  remains  regarding  how  fires  ignite  and  grow.  Computer  fire 
models  used  in  detenninistic  analysis,  for  example,  are  built  upon  observed  behavior,  but 
are  not  predictive  of  any  specific  scenario.  Variables  and  errors  in  data  inputs  into 
computer  model  introduce  additional  uncertainty.  The  performance  of  building  fire 
protection  features  as  they  interact  with  heat,  flames,  and  smoke  is  not  fully  understood. 
Human  behavior  during  fires  and  other  emergencies  varies  with  age,  risk  perception, 
cognition,  socioeconomic  status,  and  mobility;  thus,  it  is  impossible  to  predict  how 
building  occupants  will  respond  to  threatening  conditions  (Bryan,  2003).  Combined, 
these  uncertainties  often  demand  a  conservative  approach  to  building  design  to  increase 
confidence  that  safety  and  fire  resistance  are  achieved,  yet  uncertainty  can  be  reduced  as 
improvements  in  measurement  and  perfonnance  criteria  specificity  are  achieved. 

G.  SUMMARY 

In  the  last  50  years,  the  means  and  methods  for  building  design  and  construction 
have  changed  dramatically.  Not  only  have  prescriptive  designs  and  codes  been 
modernized  to  address  new  building  methods  and  materials,  but  interest  has  increased  in 
the  practice  of  performance-based  design  that  emphasizes  clearly  defined  fire  safety 
perfonnance  objectives  rather  than  arbitrary  rules.  It  is  argued  by  many  that  greater 
adoption  of  perfonnance-based  designs  will  result  in  creative  architecture,  reduced 
construction  costs,  and  a  higher  degree  of  public  safety. 

Key  to  the  successful  application  of  perfonnance-based  design  is  the  requirement 
to  identify  stakeholder  objectives  and  their  acceptable  level  of  risk,  and  develop  one  or 
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more  design  solutions  to  satisfy  them.  The  designs  are  evaluated  against  specific  fire 
scenarios,  often  using  sophisticated  computer  modeling  techniques  to  represent  fire 
behavior  in  a  variety  of  conditions.  It  is  essential  that  the  fire  scenarios  are  quantified  to 
the  extent  possible  so  objective  analysis  of  the  trial  designs  can  be  accomplished.  Since 
perfonnance-based  design  and  the  computer  models  often  used  to  test  design  hypotheses 
are  an  inexact  science,  commonly  accepted  probabilistic  and  deterministic  risk  analysis 
techniques  are  employed  to  reduce  the  uncertainty  associated  with  the  proposed  designs. 
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V.  FIRE  BEHAVIOR 


Fire  is  a  complex  thennodynamic  chemical  and  physical  phenomenon  not  entirely 
understood  by  scientists.  The  field  of  fire  behavior  studies  is  a  relatively  young  discipline 
when  compared  to  other  scientific  endeavors.  Although  ancient  alchemists  considered 
fire  one  of  the  earth’s  fundamental  elements,  it  is  now  known  that  combustion  is  a 
complex  chemical  reaction  involving  fuel  (usually  carbon  or  hydrocarbon-based72),  an 
oxidizing  agent,  and  a  competent  heat  source.  When  controlled,  combustion  is  an 
essential  part  of  day-to-day  life;  it  is  used  to  power  motor  vehicles,  support  industrial 
processes,  and  maintain  environmental  comfort.  On  the  other  hand,  the  destructive  effects 
of  unwanted  fires  kill  and  injure  thousands  and  cause  billions  of  dollars  of  direct  property 
damage  each  year  in  the  United  States.  This  section  provides  an  overview  of  fire  behavior 
in  the  built  environment  to  provide  a  framework  for  the  application  of  fire  effects 
modeling  software  to  the  research  questions.  It  is  not  intended  to  be  an  exhaustive 
discussion  of  fire  chemistry  and  physics. 

A.  COMBUSTION 

In  its  simplest  expression,  fire  involves  the  combination  of  a  fuel,  an  oxidizing 
agent,  and  a  competent  ignition  source  in  proper  proportions  to  ignite  and  sustain  the 
combustion  process.  It  is  an  exothermic  chemical  reaction  that  produces  enough  energy 
to  be  perceived  by  humans  or  instruments.  This  energy  release  is  manifested  in  the  form 
of  heat  and  light. 

Fuels  can  consist  of  many  items  in  solid,  liquid,  or  gaseous  states.  Whether  the 
furniture  in  one’s  home  or  office,  gasoline  in  one’s  motor  vehicle,  or  methane  that 
supplies  a  heating  system,  fuel  is  the  source  of  latent  energy  that  is  released  when  ignited. 
The  range  of  potential  fuels  in  the  built  environment  is  very  wide,  from  simple  gaseous 
hydrocarbons  to  solids  that  have  high  molecular  weight  and  complex  chemical 


72  Containing  atoms  of  hydrogen,  carbon,  oxygen  and  some  nitrogen. 
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composition.  Some  of  these  materials  are  naturally  occurring — such  as  cellulose — and 
others  are  manmade,  such  as  gasoline,  acetylene,  ethanol,  polyethylene,  and 
polyurethane.  Critical  to  fire  behavior  studies  is  the  understanding  that  all  combustion 
reactions  release  energy  into  the  environment.  This  energy  release  is  described  in  fire 
behavior  studies  as  the  heat  of  combustion,  or  the  total  amount  of  heat  released  when  a 
unit  of  fuel  (at  77°F  and  normal  atmospheric  pressure  [25°C  and  1  bar])  is  completely 
oxidized  in  controlled  conditions  (Drysdale,  1998).  The  energy  released  is  measured  in 
kilojoules  per  gram  (kJ/g)73  and  is  represented  by  the  expression  A//c.  Table  20  provides 
a  sample  representation  of  the  heat  of  combustion  and  chemical  formulae  of  specific 
fuels.  (Polystyrene  and  polyethylene,  common  manmade  components  in  modern  furniture 
fabrics,  are  described  as  possessing  variable  chemical  formulae  as  a  result  of  differences 
in  manufacturing  processes).  Higher  numerical  values  represent  more  potential  heat 
energy  that  may  be  released  from  the  fuel;  therefore,  higher  numerical  values  translate 
into  greater  challenges  for  fire  protection  systems  and  suppression  forces  to  control  or 
suppress  a  fire  in  these  fuels. 

Table  20.  Heat  of  Combustion  of  Specific  Fuels  (After:  Drysdale,  1998) 


Fuel 

Chemical  Formula 

A Hc 

(kJ/g) 

Dextrose 

c6h1206 

15.40 

Cellulose3 

(C6H10O5)n 

16.09 

Ethanol 

C2H5OH 

26.78 

Acetone 

(CH3)2CO 

30.79 

Polystyrene 

Variable  b 

39.85 

Benzene 

c6h6 

40.00 

Kerosene 

c12h26 

43.00 

Polyethylene 

Variable 

43.28 

73  Fire  behavior  studies  commonly  are  conducted  in  the  International  System  of  Units  (SI).  See 
Appendix  A  for  conversion  to  the  United  States  customary  system. 
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Fuel 

Chemical  Formula 

A Hc 

(kJ/g) 

Diesel  (Fuel  Oil  No.  2) 

Variable 

44.00 

Propane 

c3h8 

46.45 

Gasoline 

Variable 

47.30 

Methane 

ch4 

50.00 

Ethene 

c2h4 

50.35 

aA  generic  formula  for  cellulosic  materials,  such  as  wood,  paper,  or 
cotton. 

bMany  of  these  products  are  subject  to  changes  in  their  chemical 
formulas  during  the  refining  or  manufacturing  process. 

An  important  distinction  in  fire  studies  is  the  difference  between  heat  and 
temperature.  Heat  is  the  amount  of  energy  transferred  from  one  object  to  another  due  to 
differences  in  temperature.  Temperature,  represented  by  degrees  in  the  Fahrenheit, 
Celsius,  Kelvin,  or  Rankine  scales,  is  simply  a  measurement  of  a  material’s  molecular 
activity  compared  to  a  reference  point.  As  an  object  or  fuel  absorbs  energy  from  the 
environment  or  another  object,  molecular  activity  increases.  The  change  in  molecular 
activity  is  registered  as  temperature.  Table  21  provides  an  example  of  temperatures  and 
the  corresponding  physical  or  physiological  response. 


Table  2 1 .  Temperature  Examples  and  Corresponding  Physical  or  Physiological 

Response  (After:  Fire  Behavior,  2011) 


Temperature 

°F 

Temperature 

°C 

Response 

98.6 

37 

Normal  human  oral/body  temperature 

111 

44 

Human  skin  begins  to  feel  pain 

118 

48 

Human  skin  receives  a  first  degree  bum  injury 

131 

55 

Human  skin  receives  a  second  degree  bum  injury 

140 

62 

Burned  human  tissue  becomes  numb 

162 

72 

Human  skin  is  instantly  destroyed 
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Temperature 

°F 

Temperature 

°C 

Response 

212 

100 

Water  boils  and  produces  steam 

284 

140 

Glass  transition  temperature  of  polycarbonate 

446 

230 

Melting  temperature  of  polycarbonate 

482 

250 

Charring  of  natural  cotton  begins 

>572 

>300 

Charring  of  modem  fire  fighter  protective 
clothing  begins 

>1112 

>600 

Temperatures  inside  a  post-flashover  room  fire 

Fuels,  especially  solids  and  liquids,  may  have  to  undergo  a  physical  change  before 
they  can  be  ignited.  For  combustion  to  occur,  the  combustible  constituents  of  the  fuel 
must  exist  in  a  gaseous  state  during  which  they  can  be  mixed  with  oxygen  and  create  a 
fuel-to-oxygen  ratio  where  they  ignite  and  sustain  combustion.  Wood  products  and  most 
liquid  fuels,  for  example,  must  be  heated  to  release  the  volatile  hydrocarbon  elements  that 
eventually  burn.74  This  thermal  decomposition  is  known  as  pyrolysis.  When  the 
flammable  constituents  exist  in  a  proportion  with  oxygen  that  will  sustain  combustion, 
the  mixture  is  known  as  the  flammable  limits  or  flammable  range.  If  the  ratio  of  fuel  to 
oxygen  is  too  little  to  bum,  the  mixture  is  considered  “too  lean,”  and  conversely,  if  the 
amount  of  fuel  in  proportion  to  oxygen  is  too  great,  the  mixture  is  considered  “too  rich.” 

Oxidizing  agents  may  exist  in  solid,  liquid  or  gas  phases,  and  provide  the 
necessary  oxygen  to  support  combustion.  Fires  in  the  built  environment  require 
approximately  15-16%  oxygen  by  volume  to  sustain  combustion,  and  the  air  humans 
breathe  contains  approximately  21%  oxygen  by  volume;75  thus,  in  most  building  fires,  a 
generous  supply  of  oxygen  is  available  to  support  combustion.  In  addition,  numerous 
industrial  and  production  chemicals  contain  oxygen  molecules  that  can  be  released  during 
combustion,  which  therefore  adds  to  the  available  oxygen  in  the  environment.  For 

74  Gaseous  fuels,  e.g.,  methane  and  hydrogen,  already  exist  in  the  physical  state  that  enables  them  to 
mix  with  oxygen. 

75  The  remainder  is  approximately  78%  nitrogen  and  1%  trace  elements. 
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example,  solid  inorganic  nitrates  (sodium  nitrate,  potassium  nitrate,  and  ammonium 
nitrate)  can  melt  and  release  oxygen  and  cause  a  fire  to  intensify.  Furthermore,  molten 
nitrates  react  with  carbon-based  organic  materials  “with  considerable  violence,  usually 
releasing  toxic  oxides  of  nitrogen”  (Davenport,  2003).  A  universally  familiar  example  of 
inorganic  nitrates  used  in  criminal  or  terrorist  acts  was  the  1995  truck  bombing  of  the 
Alfred  P.  Murrah  Federal  Building  in  Oklahoma  City  that  was  destroyed  by  a  mixture  of 
diesel  fuel  (a  hydrocarbon)  and  ammonium  nitrate.76  In  fact,  the  combination  of  these 
products  is  used  routinely  as  a  commercial  blasting  agent  called  ANFO,  which  is  an 
acronym  for  ammonium  nitrate-fuel  oil.  Other  oxidizing  chemicals  that  can  easily  be 
found  in  industrial  or  retail  markets  include  hydrogen  peroxide,  potassium  chlorate, 
sodium  peroxide,  ammonium  perchlorate,  potassium  pennanganate,  and  potassium 
persulfate  (Davenport,  2003). 

The  number  and  variety  of  ignition  sources  is  substantial.  Overall,  these  sources 
are  divided  into  two  major  categories,  piloted  ignition  and  autoignition  (Quintiere,  1998). 
In  piloted  ignition,  a  heat  source,  such  as  a  spark  or  flame,  ignites  the  fuel  in  the  presence 
of  the  oxidizing  agent.  An  electrical  spark  igniting  gasoline  vapors  is  an  example  of 
piloted  ignition.  Likewise,  an  IID  placed  in  or  near  a  target  by  a  criminal  or  terrorist 
adversary  generally  employs  piloted  ignition  methods,  such  as  an  open  flame  or  spark. 
Autoignition,  in  contrast,  is  ignition  that  occurs  absent  a  spark  or  flame,  and  often  is  the 
result  of  chemical  decomposition  of  fuels.  Wet,  baled  hay  is  well  known  for  autoignition, 
and  results  in  what  is  commonly  called  spontaneous  combustion  and  is  responsible  for 
numerous  barn  fires  in  agricultural  areas.  What  is  important  to  remember  is  that  the 
energy  required  to  ignite  flammable  mixtures  is  low — a  few  tenths  of  a  millijoule77  (mJ) 
for  mixtures  in  air — thereby,  increasing  the  likelihood  that  when  a  flammable  mixture 
exists,  it  can  be  ignited  easily  (Beyler,  1995).  For  combustion  to  occur,  four  conditions 
must  exist. 


76  More  recently,  a  fire-induced  ammonium  nitrate  explosion  in  West,  Texas  resulted  in  14  deaths, 
including  10  first  responders  (Karimi&  Grinberg,  2013). 

77  Approximately  0.0002388459  calorie.  See  Appendix  A  for  conversion  to  the  U.S.  customary 
system. 
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•  The  fuel  must  exist  in  a  condition  within  its  flammable  range 

•  The  ignition  source  must  have  sufficient  energy  to  ignite  the  target  fuel 

•  There  must  be  contact  between  the  ignition  source  while  the  fuel  is  within 
its  flammable  range 

•  The  duration  of  the  contact  must  be  sufficient  to  exchange  energy  from  the 
ignition  source  to  the  fuel  (U.S.  Fire  Administration,  2010b) 

B.  FIRE  BEHAVIOR  AND  EFFECTS  IN  COMPARTMENTS 

Given  the  nearly  unlimited  potential  combinations  that  exist  in  fuels,  oxidizing 
agents,  and  ignition  sources,  combustion  science  is  complex,  and  remains  a  challenging 
and  evolving  field  of  study.  While  a  detailed  understanding  of  the  physics  and  chemistry 
of  fire  ignition  is  important  to  many  parts  of  the  scientific  community,  for  the  purpose  of 
this  thesis,  the  effects  of  sustained,  unwanted  fires  are  significant  to  comprehend  the 
problem  being  studied. 

The  term  “unwanted  fires”  describes  those  events  either  unanticipated  or  criminal 
in  nature,  and  result  in  some  insult  to  humans  or  the  built  environment.  When  an 
unwanted  fire  occurs  in  an  enclosed  space,78  its  effects  are  identifiable  by  a  set  of 
generally  deterministic  and  observable  characteristics.  Granted,  the  nature  and 
complexities  of  interactions  among  the  fuels,  oxygen  supplies,  and  ignition  sources  are 
almost  limitless,  but  fire  behavior  can  be  observed  in  several  consistent  ways.  Under 
laboratory  conditions,  complete  combustion  results  in  the  total  consumption  of  the  fuel, 
with  only  heat,  carbon  dioxide  and  water  vapor  being  emitted  (Drysdale,  1998). 
However,  in  the  built  environment,  conditions  rarely  exist  for  complete  combustion,  and 
therefore,  fires  will  emit  burned  and  unburned  constituents  that  result  in  smoke  and  other 
toxic  gases,  such  as  carbon  monoxide  and  hydrogen  cyanide.  For  the  purpose  of  the 


78  When  describing  fires  in  the  built  environment,  it  is  assumed  they  are  occurring  in  a  three- 
dimensional  space  that  usually  consists  of  a  floor,  enclosing  walls,  and  a  ceiling.  While  these  spaces  can 
assume  almost  limitless  configurations,  for  the  purposes  of  fire  studies,  they  may  be  called  compartments, 
envelopes,  rooms,  or  the  built  environment  to  represent  the  spatial  relationships. 
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following  summary  discussion,  it  is  assumed  that  adequate  fuel,  oxygen,  and  a  reliable 
ignition  source  exist  in  appropriate  conditions  to  initiate  and  sustain  a  fire  within  a 
compartment.79 

Once  ignited,  a  fire  will  continue  to  grow  until  it  reaches  extinction  by  consuming 
all  the  available  fuel  or  oxygen  in  the  surroundings  (however,  is  not  the  same  as  the 
laboratory  definition  of  complete  combustion),  or  if  the  fire  is  interrupted  by  suppression 
efforts.  Figure  7  represents  the  relationship  between  temperature  and  time  in  the  various 
stages  of  compartment  fire  development.  Note  that  for  illustrative  purposes,  the  x  and  y 
axes  are  dimensionless.  Values  are  dependent  on  specific  fire  conditions  and  the 
geometry  of  the  compartment. 


Figure  7.  Relationship  of  Temperature  and  Time  in  Compartment  Fire  Development 

(From:  Fire  Behavior,  2011) 

As  the  fire  increases  in  size,  and  combustible  materials  decompose  through 
pyrolysis,  the  ensuing  visible  flame  and  smoke  become  buoyant.  This  vertical  flame 
spread  is  called  the  fire  plume  and  delineates  the  area  in  which  flaming  combustion  is 

79  Fire  behavior  may  be  influenced  by  the  amount  of  fuel  or  ventilation  available  in  a  compartment,  or 
affected  by  the  operation  of  a  fire  protection  system,  such  as  an  automatic  sprinkler  system.  The 
multiplicity  of  possible  permutations  is  outside  the  scope  of  this  study. 
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occurring.  Heat  from  the  chemical  reaction  within  the  plume  increases  the  activity  of 
electrons  of  the  fuel’s  atoms,  and  this  increased  movement  results  in  the  emission  of 
energy  waves  visible  to  humans  (Gorbett  &  Pharr,  2011).  As  the  hot  gases  rise,  cooler  air 
is  induced  to  flow  into  the  bottom  of  the  fire  plume.  This  process  is  called  entrainment, 
and  is  responsible  for  flame  height  and  turbulence.  Temperatures  within  the  fire  plume 
vary  across  the  plume’s  width  with  the  highest  temperatures  found  at  the  center  of  the 
plume  (Quintiere,  1998). 

Heat  transfer  from  the  fire  source  to  a  target,  such  as  furniture,  draperies,  wall 
coverings,  or  other  combustible  objects,  enhances  pyrolysis.  The  amount  of  energy 
transmitted  to  a  unit  of  the  target  area  over  a  quantified  time  unit  is  called  heat  flux, 
which  is  an  important  measure  to  detennine  for  whether  combustible  targets  can  be 
ignited.  It  is  normally  measured  in  kilowatts  (kW)/m“,  kilojoules  (kJ)/m  or 
Btu/ft  -second.  The  amount  of  energy  needed  to  ignite  targets  varies  depending  upon  the 
target’s  ability  to  absorb  heat  and  its  material  composition.  Table  22  provides  examples 
of  materials  and  the  corresponding  critical  radiant  heat  flux  needed  for  ignition.  Solid 
fuels  are  generically  classified  as  thermally  thick  or  thin  depending  upon  their  ability  to 
absorb  heat  energy  and  transfer  it  throughout  the  object.  Based  upon  their  chemical  and 
physical  composition,  materials  need  not  be  physically  thicker  or  thinner  than  one 
another,  but  thermally  thick  solids  absorb  heat  energy  more  quickly  and  do  not  transfer  it 
as  quickly  as  thermally  thin  objects  do  (Gorbett  &  Pharr,  2011).  The  likelihood  of 
ignition  of  thermally  thick  or  thin  materials  can  be  predicted  through  complex 
mathematical  equations. 
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Table  22.  Critical  Radiant  Heat  Flux  Needed  for  Ignition  (After:  Society  of  Fire 
Protection  Engineers:  Task  Group  on  Engineering  Practices,  2002) 


Material 

Thickness 

(in.) 

Thickness 

(mm) 

Critical 
Radiant 
Heat  Flux 
(Btu/ft2-sec) 

Critical 
Radiant  Heat 
Flux  (kW/m2) 

Polymethyl  methacrylate3 

5/8 

15.9 

0.793 

9 

Hardboard 

1/4 

6.35 

0.881 

10 

Carpet,  acrylic 

NR 

NRb 

0.881 

10 

Fiber  insulation  board 

NR 

NR 

1.233 

14 

Hardboard 

1/8 

3.175 

1.233 

14 

PMMA  (Type  G) 

1/2 

12.7 

1.321 

15 

Asphalt  shingle 

NR 

NR 

1.321 

15 

Douglas  fir  particle  board 

1/2 

12.7 

1.409 

16 

Plywood,  plain 

1/2 

12.7 

1.409 

16 

Plywood,  plain 

1/4 

6.35 

1.409 

16 

Foam,  flexible 

1 

25.4 

1.409 

16 

Glass-reinforced  plastic 

1/12 

2.24 

1.409 

16 

Hardboard,  gloss  paint 

1/8 

3.4 

1.497 

17 

Hardboard,  nitrocellulose 
paint 

NR 

NR 

1.497 

17 

Glass-reinforced  plastic 

3/64 

1.14 

1.497 

17 

Particle  board,  stock 

1/2 

12.7 

1.586 

18 

Carpet,  nylon/wool  blend 

NR 

NR 

1.586 

18 

Gypsum  board,  wallboard 

NR 

NR 

1.586 

18 

Carpet,  wool,  untreated 

NR 

NR 

1.762 

20 

Foam,  rigid 

1 

25.4 

1.762 

20 

Fiberglass  shingle 

NR 

NR 

1.850 

21 

Polyisocyanurate 

2 

50.8 

1.850 

21 
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Material 

Thickness 

(in.) 

Thickness 

(mm) 

Critical 
Radiant 
Heat  Flux 
(Btu/ft2-sec) 

Critical 
Radiant  Heat 
Flux  (kW/m2) 

Carpet,  wool , treated 

NR 

NR 

1.938 

22 

Carpet,  wool,  stock 

NR 

NR 

2.026 

23 

Aircraft  panel,  epoxy 
Fiberitec 

NR 

NR 

2.467 

28 

Gypsum  board,  fire-rated 

1/2 

12.7 

2.467 

28 

Polycarbonate 

19/32 

1.52 

2.643 

30 

Gypsum  board,  common 

1/2 

12.7 

3.083 

35 

Plywood,  fire  retardant 

1/2 

12.7 

3.877 

44 

Polystyrene 

2 

50.8 

4.053 

46 

Also  known  as  PMMA,  a  plastic  commonly  used  in  eyewear  lenses. 
bNot  reported. 

cFiberite  is  a  trade  name  for  a  mineral  filled  epoxy  resin. 


According  to  Babrauskas  (1983),  “especially  easily  ignitable”  items  ignite  at 
critical  radiant  flux  of  10  kW/rn",  “normal”  ignitability  occurs  at  20  kW/rrT,  while 
“difficult  to  ignite”  objects  correspond  to  40  kW/nf,  including  primarily  slow  burning 
items,  such  as  institutional  and  office  furniture  (p.  25). 

Flame  temperatures  in  compartments  show  surprisingly  consistent  values  despite 
variations  in  contents  and  ventilation.  Areas  may  exist  in  which  1,652°F  (900°C)  flame 
temperatures  are  observed,  but  wide  variations  will  occur.  The  peak  fire  temperature 
normally  associated  with  compartment  fires  turns  out  to  be  around  2,192°F  (1,200°C), 
although  a  typical  post-flashover  room  fire  will  more  commonly  be  1,652-1,832°F  (900 
to  1,000°C)  (Babrauskas,  2006). 

Smoke,  which  Mulholland  (1995)  defines  as  “the  smoke  aerosol  or  condensed 
phase  component  of  the  products  of  combustion,”  is  the  visible  fire  component  in  which 
unbumed  carbon  particulate  and  other  toxic  gases  accumulate  (p.  2-217).  According  to 

Mulholland,  “smoke  aerosols  vary  widely  in  appearance  and  structure,  from  light  colored, 
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for  droplets  produced  during  smoldering  combustion  and  fuel  pyrolysis,  to  black,  for 
solid,  carbonaceous  particulate  or  soot  produced  during  flaming  combustion”  (p.  2-217). 
This  description  of  smoke  opacity  has  important  consequences  that  explain  one  way  heat 
is  transferred  in  a  compartment  fire. 

In  addition  to  fire  spread  through  direct  flame  contact,  heat  energy  is  transmitted 
through  conduction,  convection,  and  radiation.  Conduction  is  the  transfer  of  heat  due  to 
molecular  energy;  heat  is  transferred  through  the  material  by  increased  molecular 
activity.  The  heat  felt  when  holding  a  ceramic  cup  of  hot  liquid  is  the  result  of  conductive 
heat  transfer.  Convection  is  heat  transfer  from  a  moving  fluid  (liquid  or  gas)  onto  a  solid 
surface,  such  as  what  is  experienced  when  holding  a  hand  above  an  electric  or  gas 
cooking  range  element.  Radiation  is  heat  transfer  through  electromagnetic  energy.  The 
heat  absorbed  from  the  sun  is  an  example  of  the  effect  of  radiation. 

If  a  fire  possesses  adequate  energy  to  reach  the  ceiling  of  the  compartment,  the 
flames  and  other  products  of  combustion  will  travel  outward  in  all  directions80  from  the 
centerline  of  the  fire  plume.  This  horizontal  fire  spread  is  called  a  ceiling  jet  and  has  a 
significant  influence  on  heat  transfer,  as  well  as  fire  protection  systems,  such  as  detection 
devices,  or  automatic  sprinklers.  As  the  volume  of  smoke  and  heated  gases  increase  in  a 
compartment,  the  opacity  of  the  smoke  affects  heat  transfer  back  into  the  lower  levels  of 
the  compartment.  Mulholland  reported  in  1995  “a  large  fraction  of  the  radiant  energy 
emitted  from  a  fire  results  from  the  blackbody  emission  from  the  soot  in  the  flame” 
(p.  2-217).  This  heat  energy  radiates  back  into  the  compartment  and  increases  the  rate  of 
pyrolysis  of  combustible  materials.  According  to  Custer  (2003),  the  temperature  of  the 
ceiling  jet  will  decrease  as  its  radius  increases  due  to  heat  losses  to  the  ceiling  and  to  the 
entrainment  of  cooler  air  from  the  surroundings,  and  thus,  loses  energy  as  it  gets  farther 
from  the  influences  of  the  fire  plume. 


80  Assuming  the  compartment  has  a  smooth,  flat  ceiling.  Ceilings  that  slope  or  have  architectural 
features  (e.g.,  beams,  soffits,  decorations)  may  affect  ceiling  jets  differently. 
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As  the  ceiling  jet  travels  across  the  surface,  the  heated  gases  and  other  products  of 
combustion  interact  with  the  fire  protection  systems  if  present.  These  fire  products  cause 
automatic  detection  devices,  such  as  sprinklers  and  heat  detectors,  to  respond  to  thennal 
changes,  and  smoke  detection  devices  to  sense  other  products  of  combustion. 

To  be  usable,  spaces  within  the  built  environment  generally  have  openings  in  the 
form  of  windows  or  doors  to  provide  human  access  or  comfort.  These  openings  affect 
compartment  fire  behavior  by  influencing  a  fire’s  ventilation  and  its  ability  to  use  oxygen 
for  continued  combustion.  As  the  temperature  of  fire  gases  increase,  they  expand  and 
create  rising  pressure  in  the  compartment.81  The  pressure  difference  between  one 
compartment  and  another  (or  indoors  and  outdoors)  accounts  for  the  movement  of  smoke 
and  other  products  of  combustion  away  from  the  fire  source  at  higher  levels  of  the 
compartment.  Simultaneously,  cooler  air  will  enter  the  enclosure  at  the  lower  level,  often 
creating  what  appear  to  be  two  distinct  layers  of  burning  and  non-buming  environments. 
Over  time,  this  upper  layer  will  descend  toward  the  floor  as  the  volume  of  smoke 
increases  with  continuous  combustion.  As  long  as  the  fire  continues  to  grow  and  spread, 
the  upper  layer  descends  toward  the  floor  and  the  fire  inside  the  compartment  will 
maintain  positive  pressure  to  push  the  smoke  out.  If  the  fire  consumes  most  of  the 
enclosure’s  oxygen,  however,  and  begins  to  subside,  the  inside  pressure  will  drop  below 
the  outside  pressure  and  more  air  will  flow  into  the  space,  often  resulting  in  increased 
combustion,  which  can  occur  in  a  cyclical  manner  with  the  result  being  a  compartment 
fire  that  appears  to  be  breathing  as  the  air  rushes  in  and  smoke  pushes  out  (Gorbett  & 
Pharr,  2011). 

Unregulated  fire  behavior  often  is  characterized  as  fuel-controlled  or  ventilation- 
controlled.  According  to  Gorbett  and  Pharr  (2011),  a  “fuel  controlled  enclosure  fire  is 
one  that  is  not  adversely  affected  by  the  availability  of  oxygen  until  the  fire  nears  full- 
room  involvement  and  is  limited  only  by  the  availability  of  fuel  in  a  ready  state  for 
combustion”  (p.  237).  The  fire  is  controlled  by  the  fact  that  when  the  fuel  is  consumed, 
the  fire  will  diminish  toward  extinction.  A  ventilation-controlled  fire,  on  the  other  hand, 

81  Following  the  principles  of  the  ideal  gas  law. 
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suffers  from  an  inadequate  supply  of  oxygen  and  may  decay  toward  extinction.  Most  fires 
begin  as  fuel-controlled,  but  may  become  ventilation-controlled  in  the  absence  of  an 
adequate  air  or  oxygen  supply  (Gorbett  &  Pharr,  2011). 

Given  an  adequate  fuel  supply,  a  ventilation  fire  will  proceed  to  burn  to  flashover, 
the  point,  according  to  Thomas  (P.  H.  Thomas,  1983),  where  the  fire  transitions  from  a 
localized  fire  to  a  general  conflagration  within  the  compartment  in  which  all  fuel  surfaces 
are  burning,  the  fire  transitions  from  fuel-controlled  to  ventilation-controlled,  and  there  is 
a  sudden  propagation  of  flame  through  the  unbumed  gases  and  vapors  collected  under  the 
ceiling.  Depending  upon  conditions,  flashover  typically  occurs  at  about  932-1,1 12°F 
(500-600°C)  and  may  last  several  seconds.  Peacock,  Reneke,  Bukowski,  and 
Barbrauskas  (1999)  concluded  that  given  the  wide  variety  of  experimental  data,  the 
definition  of  flashover  for  fire  hazard  calculations  should  include  an  upper  gas 
temperature  of  equal  to  or  greater  than  1,112°F  (600°C)  or  a  heat  flux  at  floor  level  of 
greater  than  or  equal  to  20  kW/m".  “After  flashover  has  occurred,  the  exposed  surfaces  of 
all  combustible  items  in  the  room  of  origin  will  be  burning,  and  the  rate  of  heat  release 82 
will  develop  to  a  maximum,  producing  high  temperatures”  (Drysdale,  1998,  p.  325). 

According  to  Babrauskas  and  Peacock  (1992),  the  HRR  is  the  single  most 
important  variable  in  a  fire.  HRR  describes  the  amount  of  heat  released  over  a  unit  of 
time  by  one  or  more  burning  objects.  The  energy  release  commonly  is  expressed  in  watts 
(W),  kilowatts  (kW),  or  megawatts  (MW).83  Generally,  HRR  provides  fire  safety 
professionals  a  means  to  quantify  fire  behavior  so  it  can  be  compared  to  other  events, 
especially  in  computerized  fire  modeling  applications.  Babrauskas  and  Peacock  (as  cited 
in  Icove  &  DeHaan,  2009)  reported  that  HRR  is  “essentially  the  size  or  power  of  the  fire. 


8-  Also  known  as  heat  release  rate  (identified  with  the  acronym  HRR),  it  is  represented  by  the  symbol 
Q  where  the  dot  over  the  Q  means  per  unit  time. 

83  A  watt  is  the  amount  power  dissipated  by  a  current  of  one  ampere  flowing  across  a  resistance  of  one 
ohm.  A  kilowatt  equals  1,000  watts.  A  megawatt  equals  1,000  kilowatts. 
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.  .  .  First,  and  most  important,  heat  released  by  a  fire  is  the  driving  force 
for  that  fire  subsequently  to  produce  more  heat  by  producing  more  fuel  by 
evaporation  or  pyrolysis  ....  Second,  another  important  role  of  the  heat 
release  rate  ...  is  that  it  directly  correlates  with  many  other  variables. 
Examples  include  the  production  of  smoke  and  toxic  by-products  of 
combustion,  room  temperature,  heat  flux,  mass  loss  rates,  and  flame  height 
impingement. 

Third,  the  direct  correlation  of  heat  release  rates  and  lethality  of  a  fire  is 
significant.  High  heat  fluxes,  large  volumes  of  high-temperature  smoke, 
and  toxic  gases  may  overwhelm  occupants,  preventing  their  safe  escape 
during  fires,  (p.  66) 

Table  23  provides  examples  of  peak  heat  release  rates  for  common  objects. 


Table  23.  Peak  Heat  Release  Rates  for  Common  Objects  (After:  Icove  &  DeHaan, 
2009,  p.  67;  Bounagui,  Benichou,  &  Kashef,  2005,  pp.  2-3;  Madrzykowski, 

1996,  p.  49) 


Material 

Peak  Heat  Release  Rate 
(kW) 

Cigarette 

.005  (5  W) 

Wooden  kitchen  match  or  cigarette  lighter 

.050  (50  W) 

Candle 

.05-08  (50-80  W) 

Bookcase,  plywood  with  aluminum  frame 

25 

Wastepaper  basket  (0.94  kg) 

50 

Office  wastebasket  with  paper 

50-150 

Latex  foam  pillow  (1.24  kg) 

117 

Small  chair  with  some  padding 

150-250 

Television  set  (39.8  kg) 

290 

Modern  armchair  (41.8  kg) 

350  kW-1.2  MW 

Recliner  with  synthetic  padding  and  covering 

500-1  000  (1MW) 

Natural  Christmas  tree  (7.0  kg) 

650 

Molded  plastic  chair  (1 1.26  kg) 

700 

Metal  wardrobe  (41.4  kg) 

750 

Gasoline  pool  (1.89  L,  on  concrete) 

1  MW 

Christmas  tree  (dry,  1.83  to  2.1  m) 

1-5  MW 
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Material 

Peak  Heat  Release  Rate 

(kW) 

Sofa  with  synthetic  padding  and  covering 

1-3  MW 

Plywood  wardrobe  with  fabric 

3-6  MW 

Living  room  or  bedroom  (fully  involved) 

3-10  MW 

Office  workstation  with  privacy  panels 

2. 8-6.9  MW 

While  Figure  7  may  represent  the  fire  growth  and  extinction  of  a  typical 
compartment  fire,  current  research  shows  that  fire  growth  and  its  corresponding  energy 
release  is  heavily  dependent  on  the  nature  of  the  fuel  consumed.  Citing  research 
conducted  by  the  Factory  Mutual  Research  Corporation,  Evans  (1995)  reported  that  fire 
growth  and  HRR  might  be  assumed  to  occur  in  four  general  categories:  ultra-fast,  fast, 
medium,  and  slow  that  describe  the  correlation  between  time  and  their  maximum  HRR. 
in  these  categories,  the  HRR  grows  proportionately  to  the  square  of  time,  and  have 
become  known  as  t-squared  (t  )  fires.  According  to  Fleming  (2003): 

fn  the  1980s,  fire  protection  scientists  and  engineers  introduced  the 
concepts  of  “slow,”  “medium,”  and  “fast”  t-squared  fires  to  represent  a 
range  of  expected  rates  of  heat  release  for  fire  modeling.  Basically,  a  slow 
t-squared  fire  reaches  a  burning  rate  of  1,000  Btu/s  (1  055  kW)  in  600 
seconds,  while  a  medium  t-squared  fire  reaches  that  rate  in  300  seconds 
and  a  fast  fire  in  150  seconds. 

The  concept  of  the  ultra-fast  t-squared  fire  was  introduced  shortly  after  the 
concepts  of  the  slow,  medium,  and  fast  fires  when  it  became  apparent  that 
the  range  of  those  three  design  fires  wasn’t  sufficient  to  capture  some  of 
the  more  important  fire  challenges.  The  ultra-fast  t-squared  fire  reaches 
the  burning  rate  of  1,000  Btu/s  (1,055  kW)  in  75  seconds,  (p.  26) 

Fleming’s  comment  that  the  t  fires  are  used  in  fire  modeling  explains  how  in 
Table  17 — Design  Fire  Scenarios  from  NFPA  101,  Life  Safety  Code — the  various  fire 
scenarios  are  employed  for  the  purposes  of  evaluating  performance-based  designs.  Figure 
8  illustrates  the  four  t  HRR  curves  with  examples  of  the  products  tested  to  obtain  the 
results. 
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Thin  Plywood  stacked 
Wardrobe  pa|tets 


2 

Figure  8.  Heat  Release  Rate  (HRR)  Curves  for  Sample  t  Fires  (From:  Fire  Behavior, 

2011) 


C.  SMOKE  AND  TOXICITY 

While  the  dramatic  visual  effect  of  a  fire’s  flames  is  impressive,  the  real  threat  to 
human  survivability  is  smoke.  According  to  Hall  (2011),  between  51%  and  73%  of  fire 
deaths  are  attributable  to  smoke  inhalation  alone,  while  the  combined  effect  of  smoke 
inhalation  and  bums  is  about  74%.  Most  fire  deaths  (85%)  occur  in  residential  settings, 
yet  since  2003,  an  average  109  people  die  in  non-residential  fires  each  year  and  the  data 
show  a  recent  trend  upward  (Karter,  2010).  This  thesis  explores  these  non-residential 
buildings  and  facilities  in  which  occupants  are  assumed  to  be  expected  to  be  awake,  alert, 
oriented  to  their  surroundings,  and  capable  of  self-preservation,  or  by  assistance  from 
others. 

Smoke  is  emitted  from  a  fire  when  the  combustion  process  is  not  complete,  as  is 
typical  of  most  fires  outside  controlled  laboratory  environments.  Smoke  may  contain 
unbumed  particulate  matter,  toxic  fire  gases,  water  vapor,  and  other  constituents 
transported  away  from  the  fire  by  convection.  Butler  and  Mullholland  (2004)  reported 

that  increasing  concern  exists  about  the  less-than-lethal  effects  of  smoke  generated  by 
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fires  even  in  those  environments  — such  as  the  workplace — in  which  exposed  persons 
may  be  fully  cognizant  of  their  surroundings  and  capable  of  self-preservation. 

The  eye  and  lung  irritation  due  to  irritant  gases  and  aerosols  and  the 
confusion  due  to  asphyxiants  may  slow  escape  or  cause  incapacitation. 

The  inhalation  of  a  large  concentration  of  soot  and  toxic  gases  may  lead  to 
lung  edema  and  inflammation,  causing  death  a  short  time  after  the  fire  (p. 

149). 

The  number  and  potential  combinations  of  lethal  and  sub-lethal  combustion  products 
found  in  smoke  is  limited  only  by  the  combination  of  fuels  burning  and  the  environment 
in  which  they  occur.  Hundreds  of  studies  have  been  conducted  throughout  the  world  to 
assess  smoke  constituents  and  their  lethality  (See  Levin  &  Kuligowski,  2005;  Gann, 
1992;  Gann,  2001;  Pitts,  2001).  According  to  Purser’s  review  (1995),  two  critical 
observations  about  fire  product  toxicity  are  known:  1)  in  environments  in  which  fires 
occur,  a  large  number  of  potentially  toxic  products  occur  depending  upon  the  chemical 
decomposition  of  the  burning  material  and  the  available  oxygen,  and  2)  despite  the  huge 
potential  of  variable  conditions,  “the  basic  toxic  effects  were  relatively  simple.  For  each 
individual  smoke  atmosphere  the  toxicity  was  dominated  either  by  a  narcotic 
(asphyxiant)  gas  [CO  or  HCN]84  or  by  irritants”  (p.  2-87).  Gann  (2008)  added  very 
succinctly,  “of  the  sublethal  [sic]  effects  of  fire  effluent,  incapacitation  is  frequently 
tantamount  to  lethality.  If  a  person  is  rendered  unable  to  effect  his  or  her  own  escape,  and 
if  the  fire  and  its  effluent  continue  to  spread,  the  person’s  survival  is  threatened”  (p.  4). 

The  toxicity  of  smoke  products  generally  is  described  in  tenns  of  its  lethal 
concentration  and  is  standardized  for  comparison  by  the  descriptor  LC50..85  Doses  are 
measured  in  parts  per  million  in  the  volume  of  the  compartment  under  study  (ppmv);  the 
lower  the  LC50  value,  the  more  toxic  the  product.  It  might  be  assumed,  however,  that 

84  CO  is  the  chemical  formula  for  carbon  monoxide,  and  HCN  is  the  chemical  formula  for  hydrogen 
cyanide. 

8^  The  LC50  value  is  the  result  of  statistic  calculation  based  on  multiple  experiments,  each  with 
multiple  animals,  and  indicates  the  concentration  at  which  50%  of  the  experimental  animals  exposed  for  a 
specific  length  of  time  would  be  expected  to  die  either  during  the  exposure  time  of  the  post-exposure 
observation  period  (Levin  &  Kuligowski,  p.  210).  For  fire  toxicity  data,  the  exposure  period  normally  used 
is  30  minutes  (Babrauskas,  1997). 
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people  who  are  alert  and  oriented  would  be  expected  to  evacuate  or  seek  shelter  before 
being  exposed  to  lethal  concentrations  of  toxic  gases.  According  to  Babrauskas  (1997), 
concentrations  of  toxic  gases  that  have  a  narcotic  effect  and  may  incapacitate  a  person  to 
compromise  or  prevent  the  self-evacuation  are  important,  but  are  problematic  to 
determine.  Another  value,  the  hypothetical  incapacitation  level — referred  to  as  the 
effective  concentration  (EC50) — has  been  recommended  by  National  Institute  of 
Standards  and  Technology  (NIST)  in  reducing  the  LC50  by  two  to  four  times.  Table  24 
lists  a  few  of  the  known  toxic  products  of  combustion  and  their  lethal  and  effective 
concentrations. 


Table  24.  Lethal  and  Effective  Concentrations  of  Some  Toxic  Products  of  Combustion 

(After:  Babrauskas,  1997) 


Gas 

Assumed3 

human 

LC50 
(5  min) 

Assumed 
human  LC5o 
(30  min) 

Assumed 

ec50 

(5  min) 

Assumed 

ec50 

(30  min) 

Carbon  dioxide 

>150,000 

>150,000 

- 

- 

Acetaldehyde 

- 

20,000 

- 

- 

Ammonia 

20,000 

9,000 

mb:  20,000 

r:  10,000 

m:  4,400 

r:  4,000 

Hydrogen  chloride 

16,000 

3,700 

- 

- 

Carbon  monoxide 

- 

3,000 

- 

- 

Hydrogen  bromide 

- 

3,000 

- 

- 

Nitric  oxide 

10,000 

2,500 

- 

- 

Carbonyl  sulfide 

- 

2,000 

~ 

- 

Hydrogen  sulfide 

- 

2,000 

- 

- 

Hydrogen  fluoride 

10,000 

2,000 

- 

- 

Acrylonitrile 

- 

2,000 

- 

- 

Carbonyl  fluoride 

- 

750 

- 

- 

Nitrogen  dioxide 

5,000 

500 

m:  2,500 

r:  5,000 

m:  700 

r:  300 

Acrolein 

750 

300 

- 

- 

Formaldehyde 

- 

250 

~ 

- 

Sulfur  dioxide 

500 

— 

— 

— 
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Gas 

Assumed3 

human 

LC50 
(5  min) 

Assumed 
human  LQ0 
(30  min) 

Assumed 
EQo 
(5  min) 

Assumed 
ECS0 
(30  min) 

Hydrogen  cyanide 

280 

135 

Toluene  diisocyanate 

- 

100 

~ 

- 

Phosgene 

50 

90 

- 

- 

Perfluoroisobutylene 

28 

6 

— 

— 

JA11  units  are  reported  in  parts  per  million  by  volume  (ppmv). 

b 

m  =  mouse,  r  =  rat. 


In  a  more  recent  study,  using  computer  modeling,86  Peacock,  Averill,  Reneke  and 
Jones  (2004)  found  that  for  fires  that  had  not  reached  flashover,  within  the  room  in  which 
the  fire  starts,  the  incapacitation  from  heat  generally  will  occur  before  narcotic  gas 
concentrations  reach  even  1%  of  lethal  conditions.87  Importantly,  they  found  that  once 
outside  the  room  of  origin — especially  in  buildings  with  large  rooms — smoke  is  diluted 
rapidly  and  the  smoke  exposure  effects  would  occur  well  after  a  victim  is  incapacitated 
by  heat.  In  “residential  buildings  and  other  buildings  with  ordinary  size  rooms, 
incapacitation  from  smoke  inhalation  will  rarely  occur  before  incapacitation  from  heat 
and  thermal  radiation  or  escape  or  rescue”  (p.  145).  This  claim  is  significant  and  is  based 
on  modeling  that  should  be  compared  to  real-world  results. 

Another  concern  about  smoke  is  its  effect  on  visual  acuity  and  the  ability  of 
people  who  are  trying  to  escape  a  fire  to  negotiate  the  means  of  egress  to  safety.  In  her 
2009  meta-analysis,  Kuligowski  (2009)  found  limited  visibility  caused  by  smoke  could 
affect  both  an  individual’s  ability  to  escape  a  building  with  the  corollary  outcome  that  a 
decrease  in  walking  speed  could  affect  both  an  individual’s  ability  to  escape  and  the 
subsequent  ability  to  move  around  a  building  to  perfonn  a  work  task  or  tasks.  According 
to  Kuligowski ’s  research: 


86  They  modeled  prototypical  ranch  house,  hotel,  and  office  configurations,  all  of  which  comprised 
one-story  scenarios. 

87  “The  exception  to  this  involves  smoldering  fires  that  generate  little  heat  and,  with  little  buoyancy  to 
drive  mixing  throughout  the  space,  can  readily  generate  incapacitating  exposures,  especially  for  occupants 
intimate  to  the  smoldering  item”  (p.  144). 
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A  high  smoke  obscuration  is  likely  to  affect  an  individual’s  safety  in  a 
building.  Exposures  to  thick,  dense  smoke  can  negatively  affect  an 
individual’s  ability  to  see  their  surrounding  environment,  and  in  turn, 
affect  their  speed  of  movement  throughout  a  smoke-filled  space  and  their 
concentration  on  a  job  task.  The  density  of  the  smoke  itself  affects 
visibility  as  well  as  the  irritancy  of  the  smoke.  In  some  cases,  irritants  can 
be  so  potent  that  individuals  cannot  open  their  eyes  to  see.  (p.  3 1) 

The  importance  of  understanding  the  relationship  between  smoke  toxicity  and 
obscuration  is  its  role  in  affecting  escape  time.  In  the  mid-1970s,  fire  protection 
professionals  began  employing  the  concepts  of  required  safe  egress  time  (RSET)  and 
available  safe  egress  time  (ASET).  In  theory,  building  occupants — once  notified  or 
becoming  aware  of  a  threat,  such  as  a  fire — required  a  certain  amount  of  time  (the  RSET) 
to  respond  to  the  threatening  cues  and  take  appropriate  action  to  evacuate  the  premises. 
Empirical  studies  and  mathematical  human  evacuation  models  led  to  the  ASET  concept 
that  measured  the  amount  of  time  available  for  egress  before  the  occupant  was  in 
imminent  danger.  If  combined  fire  effects  and  evacuation  models  showed  that  the  ASET 
was  less  than  the  RSET  (occupants  could  escape  before  encountering  fire  or  smoke),  the 
means  of  egress  design  was  deemed  to  comply  with  the  perfonnance  requirements  of  the 
building  or  fire  codes. 

According  to  Chu,  Sun,  Sun,  Chen,  and  Chen  (n.d.)  tenability  is  lost  when 
occupant  incapacitation  is  predicted  from  exposure  to  smoke. 

ASET  is  dominated  by  ignition,  fire  growth  and  the  spread  of  fire  and  fire 
smoke.  These  depend  upon  a  range  of  variables,  such  as  fire  load,  the 
reaction  to  fire  properties  of  the  lining  materials  and  contents,  the  height 
and  ventilation  of  the  compartment  and  the  characteristics  of  the  fire 
effluent,  (p.  351) 

By  comparison,  “RSET  is  related  to  fire  detection  and  alann,  occupant  characteristics 
(such  as  age,  sex,  physical  and  mental  ability,  sleeping  or  waking,  population  density), 
human  behavior  in  fire  (such  as  seeking  information,  collecting  belongings,  choosing  an 
exit)  and  building  characteristics  (such  as  corridor  width,  exit  numbers  and  widths)”  (p. 
351).  Chu  et  al.  (n.d.)  developed  a  simple  timeline  diagram  to  illustrate  the  relationship 
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between  ASET  and  RSET  (Figure  9).  The  vertical  line  at  the  left  of  the  illustration 
represents  the  time  at  which  a  fire  ignites,  and  the  subsequent  events  are  to  the  right  of 
this  vertical  line. 


Figure  9.  ASET  and  RSET  Comparative  Timeline  (After:  Chu  et  ah,  n.d.) 


where 

td  =  time  from  ignition  to  detection 

4  =  time  to  alann  operation  and  notification 

tp  =  occupant  pre-movement  time88 

tm  =  occupant  movement  time  to  travel  to  a  place  of  safety 

Recently,  Babrauskas,  Fleming  and  Russell  (2010)  expressed  criticism  that  the 
RSET/ASET  concept  was  overly  simplistic  and  could  not  anticipate  the  broad  of 
conditions,  capabilities,  and  constraints  that  building  occupants  might  face  in  fires. 
Babrauskas  et  al.  (2010)  recommended  that  the  RSET/ASET  concept  be  abandoned  in 
favor  of  other  analytical  tools  that  employ  a  comparative  margin  of  safety  analysis,  but  at 
this  time,  those  tools  do  not  exist.  Chu  et  al.  (n.d.)  agreed  that  for  RSET  calculations, 
“occupant  pre-movement  time  is  often  ignored  or  oversimplified  to  be  defined  as  an 


88  The  time  after  an  alarm  or  cue  (such  as  smoke  or  eyewitness  reports  of  a  fire)  is  evident  but  before 
the  occupants  of  a  building  begin  to  move  towards  an  exit. 
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explicit  value  in  fire  risk  assessment.  In  fact,  occupant  pre-evacuation  time  is  not  an 
explicit  value  but  a  random  variable  which  follows  some  probability  distribution”  (p. 
352). 

D.  SUMMARY 

Fire  is  a  complex  thermodynamic  chemical  and  physical  phenomenon  not  entirely 
understood  by  scientists  or  fire  protection  engineers.  The  almost  incalculable 
combination  of  fuels,  ventilation,  and  ignition  sources,  and  the  nearly  limitless  potential 
configurations  of  building  materials  and  designs,  makes  detailed  scientific  analysis 
complicated.  The  effects  of  solid,  liquid,  or  gas  fuels,  how  they  are  arrayed  in  a 
compartment,  and  their  interaction  with  one  another  in  fire  conditions,  are  subjects  for 
study  beyond  this  thesis.  The  purpose  of  this  overview  is  to  prepare  the  reader  to  be 
familiar  with  the  data  inputs  and  ranges  of  possible  results  that  occur  in  the  fire  modeling 
applications  of  the  thesis  research. 
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VI.  FIRE  AS  A  WEAPON 


Fire  has  been  used  as  a  weapon  for  millennia.  The  ease  with  which  it  can  be 
started,  and  the  significant  damage  it  can  cause,  makes  it  a  useful  tool  to  threaten  or 
destroy  enemies.  News  articles  and  journals  continue  to  be  filled  with  references  to  using 
fire  as  a  weapon  in  a  variety  of  venues.  In  May  2012,  A1  Qaeda’s  English  language 
magazine  Inspire  included  a  how-to  article  encouraging  adherents  to  set  fires  in 
America’s  wildland-urban  interface  to  create  fright  and  cause  significant  economic 
disruption. 

Our  Prophet  mentioned  to  use  that  the  weapon  of  fright  is  among  the 
strongest  weapons  which  the  Muslim  ummah  of  Muhammad  is 
distinguished  with. 

.  .  .  fire  is  one  of  the  soldiers  of  Allah  which  He  sends  upon  the 
disbelievers  and  controlling  it  is  all  cases  is  impossible,  because  if  the 
Almighty  Allah  commanded  to  destroy,  He  destroys.  (AQ  Chef,  2012,  p. 

35) 

A  second  article  in  the  same  Inspire  issue  provided  religious  justification  for  arson 
through  a  Sharia  ruling  stating,  “.  .  .  it  is  ok  to  bum  their  fortresses  with  fire,  to  drown 
them  with  water  and  to  ruin  and  demolish  them.  .  .”  (al  Nadari,  2012,  p.  46). 

Despite  the  fact  that  in  recent  years  the  leading  cause  of  fires  in  non-military 
federal  buildings  was  some  sort  of  electrical  malfunction,  concern  still  exists  regarding 
malicious  acts  against  federal  properties.  The  sheer  number  of  federal  properties  and  the 
often-easy  access  that  the  public  has  to  them  creates  a  vulnerable  environment  that  is  a 
challenge  to  protect.  According  to  the  ISC  DBT  ,  the  threat  to  federal  facilities  from  a  fire 
attack  is  real. 

This  section  provides  an  overview  of  the  use  of  fire  as  a  weapon  with  IID  in  the 
built  environment,  and  looks  at  some  of  the  current  and  emerging  threats  to  federal 
buildings  and  facilities. 
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A.  FIRE  ATTACKS  ON  FEDERAL  FACILITIES 

Although  its  incident  data  does  not  clearly  identify  trends,  the  federal  government 
considers  arson  a  legitimate  security  and  terrorist  threat  to  its  buildings  and  facilities  in 
the  United  States.  The  use  of  fire  as  a  weapon  against  federal  property  is  not  new.  The 
Terrorism  Threat  Handbook  (Interagency  OPSEC  Support  Staff,  2001)  reported  while 
only  a  single  arson  attack  against  a  U.S.  facility  and  five  firebombing  incidents  were 
reported  in  1998,  the  following  year,  six  arson  attacks  and  12  attacks  that  employed 
firebombs  were  reported.89 

In  all  types  of  property,  arson  in  the  United  States  accounted  for  an  estimated 
210,300  intentionally  set  fires  each  year  from  2004  to  2006.  Intentionally  set  fires 
account  for  13%  of  fires  responded  to  by  U.S.  fire  departments.  These  fires  resulted  in  an 
average  of  approximately  375  deaths,  1,300  injuries,  and  $1.06  billion  in  property  loss 
each  year  (U.S.  Fire  Administration,  2009).  In  the  GSA’s  non-military  federally  owned  or 
leased  properties  alone,  from  2008  to  2010,  55  fires  resulted  in  $10,647,586  damage. 
More  than  5%  of  these  fires  were  attributed  to  arson  or  domestic  terrorist  attack  (J. 
Elvove,  personal  correspondence,  May  10,  2011).  Federal  buildings,  as  iconic  targets,  are 
vulnerable  to  arson  attacks  by  any  number  of  people  or  organizations  that  may  wish  to 
disrupt  government  services  or  make  a  political  or  religious  statement.  The  following 
incidents  are  just  a  few  of  the  reported  attacks  on  federal  properties. 

•  In  St.  Louis  on  April  25,  2012,  a  33-year-old  man  was  charged  for 
firebombing  a  federal  building  with  a  9.5  oz  (281  mL)  liquid  filled 
glass  container  (KSDK,  2012) 

•  Bottles  similar  to  the  one  used  in  the  St.  Louis  attack  and  sold  by  a 
prominent  retailer  were  described  by  a  New  York  City  Bomb 
Squad  technician  as  the  “perfect  containers”  for  a  Molotov 
cocktail: 


89  The  report  does  not  define  a  firebomb  nor  differentiate  between  an  arson  or  firebomb  attack.  The 
specific  locations  of  these  incidents  were  not  reported. 
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They  are  excellent  for  what  you  need,  because  it  is  a  weak-sided  bottle 
with  a  screw-on  cap,”  Mr.  Barry  said.  “It  is  small  enough  to  be  concealed 
in  your  pocket  and  it  fits  in  your  hand,  so  you  can  throw  it  almost  like  a 
Nerf  football.  It’s  a  small  projectile  you  can  get  a  good  grip  on  and  you 
can  toss  it.  (Baker,  2012) 

•  Two  persons  were  arrested  May  20,  2009  in  Sacramento, 
California  for  leaving  an  incendiary  device  inside  a  paper  bag  next 
to  the  federal  courthouse.  (News  10/KXTV,  2009) 

•  On  October  4,  2010,  a  man  set  fire  to  the  U.S.  Probation  Office  in 
Plymouth,  Massachusetts,  causing  an  estimated  $500,000  loss. 
(Harbert,  2010) 

•  A  non-scientific  survey  of  national  news  media  found  anecdotal 
evidence  of  arson  attacks  on  federal  buildings  in  five  states, 
attributed  to  suspects  upset  about  court  cases,  tax  burdens  and  drug 
indictments.  (“Federal  Building  Fire,”  2008;  Legere  &  Finucae, 

2010;  “Sprinkler  Contains  Federal,”  1989;  Jackson,  1990) 

•  Buildings  in  New  York’s  World  Trade  Center  complex  that  were 
destroyed  by  fire  on  September  11,  2001  housed  a  diverse  group  of 
federal  agencies  including  the  Secret  Service,  Security  and 
Exchange  Commission,  Federal  Home  Loan  Mortgage 
Corporation,  Equal  Employment  Opportunity  Commission,  Central 
Intelligence  Agency,  and  Internal  Revenue  Service.  (“Building  7’s 
Exclusive,”  2007) 

The  FPS  is  responsible  for  the  protection  of  GSA  owned  and  leased  properties 
included  in  this  study.  In  its  2010  analysis  of  625  fire-related  incidents,  only  a  single  case 
of  arson  was  reported,  and  another  64  events  were  classified  as  structure  fires, 
unclassified  or  undetermined  origin  (M.  Harvey,  personal  communication,  August  2, 
2011).  The  DHS  Infrastructure  Threat  Analysis  Branch  conducted  a  yearlong  study  of 
federal  and  local  courthouses,  and  detennined  that  while  23  reported  cases  of  threats  and 
other  suspicious  incidents  were  reported,  none  had  a  nexus  to  terrorism  (Infrastructure 
Threat  Analysis  Branch,  2010).  The  report  included  two  key  findings  applicable  to  this 
study. 
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•  The  DHS/Office  of  Intelligence  and  Analysis  (I&A)  has  no  credible  or 
specific  reporting  indicating  preoperational  activity  or  imminent  plans  by 
al-Qa’ida  or  other  terrorist  or  violent  extremist  organizations  to  attack 
courthouses  in  the  United  States 

•  Based  upon  an  analysis  of  the  threats  and  suspicious  activities  .  .  .  ,  the 
majority  of  threats  likely  were  conveyed  by  individuals  intending  to  delay, 
cancel,  or  harass  court  proceedings  (2010,  p.  3) 

The  United  States  Fire  Administration’s  (USFA)  National  Fire  Incident  Reporting 
Systems  (NFIRS)  collects  data  from  more  than  22,000  local  fire  departments,90  but  does 
not  pennit  discretization  from  that  data  set  of  fire  incident  data  by  federal  property 
ownership  or  tenancy.  Therefore,  it  is  impossible  to  detennine  how  many  arson  fires 
occurred  in  federally  occupied  or  controlled  buildings  or  facilities.  Table  25  summarizes 
the  most  recent  three-year  period  of  arson  fires  for  specific  property  uses  in  the  general 
U.S.  built  environment.  Table  26  provides  data  from  the  GSA.91 


90  A  fire  service  census  conducted  by  the  U.S.  Fire  Administration  shows  that  the  United  States  has  64 
executive  branch  fire  departments,  most  of  which  protect  wildland  property  through  the  U.S.  Forest  Service 
or  Department  of  the  Interior.  In  most  cases,  non-military  federal  buildings  receive  their  fire  protection 
services  from  local  fire  departments.  See  http://apps.usfa.fema.gov/census/search.cfm. 

9*  Since  the  NFIRS  system  does  not  permit  discretization  by  property  ownership,  it  is  acknowledged 
that  some  of  these  events  may  have  been  reported  by  both  the  local  fire  services  and  the  separate  GSA 
reporting  system.  Furthermore,  the  process  of  voluntary  data  submission  and  processing  results  in  a 
database  is  approximately  one  reporting  year  behind  the  current  calendar. 
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Table  25.  Fire  Incident  Data  in  Selected  Property  Types,  General  U.S.  Built  Environment,  2007-2009  (After:  B.  Pabody, 

personal  communication,  March  27,  2011) 


Year 

2007 

2008 

2009 

Summary 

Property 

type 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Total 

arson 

fires 

Arson 

% 

Total 

Office 

4,750 

247 

5.2 

4,392 

235 

5.3 

3,852 

190 

4.9 

12,994 

672 

5.17 

Courthouse 

129 

1 

0.07 

84 

2 

2.3 

85 

6 

7.0 

298 

9 

3.02 

Total 

4,879 

248 

5.08 

4,476 

237 

5.29 

3,397 

196 

5.7 

13,292 

681 

5.12 

"able  26.  Fire  Incident  Data  in  Selected  Property  Types,  GSA  Properties,  2008-2010  (From:  J.  Elvove,  personal 

communication,  May  10,  201 1) 

Year 

2008 

2009 

2010 

Summary 

Property 

type 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson 

fires 

% 

Total 

fires 

Arson  , 
fires 

% 

Total 

fires 

Total 

arson 

fires 

Arson 

% 

Total 

Office 

16 

1 

6.2 

11 

1 

9.1 

14 

0 

0 

44 

2 

4.5 

Courthouse 

5 

0 

0 

1 

0 

0 

0 

0 

0 

6 

0 

0.0 

Total3 

21 

1 

4.8 

12 

1 

8.3 

14 

0 

0 

50 

2 

4.0 

aRetail  and  mobile  property  types  have  been  deleted  from  the  entire  GSA  data  set  in  this  comparison. 
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Depending  upon  the  data  source,  the  fire  and  arson  data  picture  among  GSA 
properties  is  not  entirely  clear.  In  comparison  to  the  GSA  data,  the  DBT  cites  FBI 
Uniform  Crime  Reporting  data  and  DHS’  FPS  records  that  indicate  that  from  2007 
through  2010,  nine  arson  cases  were  reported  among  approximately  9,000  GSA 
properties. 

According  to  Baird  (2006),  “historical  analysis  of  incidents  coupled  with  open 
source  information  reveals  that  terrorist  groups  in  general  are  adapting  toward  simple 
destructive  methods  like  arson  with  increasingly  high  levels  of  fatalities”  (p.  416). 
Bjelopera  and  Randol  (2010)  found  that  19  of  43  homegrown  jihadist  terrorist  plots 
targeting  the  United  States  since  September  11,  2001  were  involved  in  whole  or  in  part 
with  explosives  or  incendiary  devices.  They  concluded: 

Historically,  most  terrorist  incidents  in  the  United  States  have  involved 
bombs  or  fires.  According  to  research  drawn  from  the  National 
Consortium  for  the  Study  of  Terrorism  and  Responses  to  Terrorism’s 
Global  Terrorism  Database,  about  83%  of  all  terrorist  incidents  on  U.S. 
soil  between  1970  and  2007 — including  violent  jihadists  as  well  as  non- 
jihadists — have  included  explosives  or  incendiary  devices,  (p.  27) 

In  contrast,  Center  for  Homeland  Defense  and  Security  professor  and  RAND 
Institute  analyst  Dr.  Seth  Jones  offered  a  qualified  assessment  that  the  al  Qaeda  threat  is 
overstated. 

I  have  reviewed  much  of  the  U.S.  government  analysis  of  al  Qa’ida 
leaders,  including  the  interrogations  of  key  leaders  (Khalid  Sheikh 
Mohammad,  Abu  Zubaydah,  Abd  al-Hadi  al-Iraqi,  etc.) — and  can’t 
remember  ever  seeing  this  come  up.  Many  other  things  do,  including 
attacks  against  subways,  trains,  airplanes,  etc.  Pyroterrorism  is,  of  course, 
a  problem — as  is  arson  more  broadly,  (personal  communication,  May  9, 

2011) 

In  its  analysis  of  the  arson  threat  on  federal  properties,  the  DBT  emphasizes  threats  from 
domestic  terrorist  groups  focused  on  environmental  issues:  the  Animal  Liberation  Front 
(ALF)  and  the  Earth  Liberation  Front  (ELF),  both  of  which  commonly  use  fire  as  their 
preferred  weapon  of  disruption  and  destruction  (Deshpande,  2009). 
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The  potential  for  eco-terrorists  and  other  like-minded  extremists  to  use 
arson  as  an  attack  method,  to  include  IIDs  (Improvised  Incendiary 
Devices),  makes  it  likely  that  this  type  of  attack  will  continue  in  the  future. 

The  frequency  of  attacks  may  increase  commensurate  with  the  frequency 
of  Federal  properties  expanding  into  wilderness  areas.  (U.S.  Department 
of  Homeland  Security,  2010a;  U.S.  Department  of  Homeland  Security, 

2010a,  p.  7.2.4) 

Similarly,  a  controversial  DHS  intelligence  assessment  on  domestic  rightwing 
extremism  concluded  that  economic  and  political  conditions  existed  in  2009  similar  to  the 
1990s,  when  the  number  of  domestic  rightwing  terrorist  and  extremist  groups  rose,  with  a 
corresponding  increase  in  violent  attacks  targeting  government  facilities,  law 
enforcement  officers,  banks,  and  infrastructure  sectors  (Extremism  and  Radicalization 
Branch,  Homeland  Environment  Threat  Analysis  Division,  2009).  The  intelligence 
assessment  did  not  speculate  on  the  manifestation  or  frequency  of  attacks  that  might  be 
conducted  by  these  groups. 

B.  IMPROVISED  INCENDIARY  DEVICES  (IID) 

Substantial  research  exists  on  IED,  especially  in  the  war  zones  of  Afghanistan  and 
Iraq,  and  as  a  technique,  their  use  in  terrorist  attacks  on  military  and  civilian  populations 
in  densely  populated  urban  areas.  While  the  destructive  forces  of  IED  often  are  the 
primary  concern  of  federal  security  professionals  trying  to  protect  assets  from  a  terrorist 
attack,  a  direct  chemical  and  physical  link  exists  between  IED  and  IID.  In  fact,  many 
descriptions  of  IED  include  references  that  they  contain  incendiary  or  pyrotechnic 
constituents  (Finegan,  2006;  Bush,  2007;  Wilkinson,  Bevan,  &  Biddle,  2008).  The 
instantaneous  oxidation  that  occurs  when  an  IED  explodes  is  the  same  chemical  reaction 
that  occurs  in  a  fire;  only  the  speed  with  which  the  chemical  reaction  and  the  ensuing 
shock  wave  occur  are  different.92 


92  Explosions  often  are  characterized  as  “detonations”  in  which  the  shock  wave  exceeds  the  speed  of 
sound  (approximately  786  miles  per  hour  in  dry  air  at  68°F  [335  m/s  at  20°C]).  Sub-sonic  shock  waves — 
typically  resulting  from  ignition  of  volatile  flammable  liquid  vapors — are  known  as  “deflagrations.” 
Variables,  such  as  relative  ambient  humidity  or  the  proportion  of  volatiles  to  air,  can  affect  these  values 
(Zalosh,  2003). 
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Furthermore,  the  instantaneous  oxidation  of  an  IED  may  be  the  trigger  for  a 
secondary,  fire  bomb-type  device.  The  car  bomb  parked  May  2,  2010  in  New  York  City’s 
Times  Square  by  Faisal  Shahzad  contained  10  gallons  of  gasoline  and  three  25-pound 
liquefied  petroleum  gas  cylinders  (“Faisal  Shahzad  Sentenced,”  2010).  As  Sweetow 
(2009)  reported,  “while  many  people  incorrectly  refer  to  the  9/11  attacks  in  the  colloquial 
as  ‘bombings,’  they  were  actually  incendiary  attacks  combining  the  kinetic  energy  of  fast 
moving  jets  with  tens  of  thousands  of  gallons  of  jet  fuel,  to  devastating  effect”  (p.  33). 
Schubert  (2008)  contended  that  flammable  fuels — when  finely  atomized  by  an  accident 
or  primary  explosion — can  produce  pressure  waves  that  result  in  severe  proximal 
destruction. 

Improvised  incendiary  devices  exist  in  a  variety  of  fonns  and  sizes  ranging  from 
handheld  containers  with  simple  cloth  or  paper  wicks  (famously  known  as  Molotov 
cocktails)  to  transportation  apparatus  and  systems  that  carry  a  variety  of  flammable 
liquids  and  gases  that  could  be  ignited  for  nefarious  purposes.  The  Internet  provides  easy 
access  to  improvised  incendiary  device-making  instructions  in  written  and  video  fonnats 
(“How  to  Build  an  Incendiary  Bomb,”  2007;  Helmenstine,  2011;  Dilegge,  2010;  How  to 
Make  a  Bomb,”  2011;  “How  to  Make  a  Fire  Bomb,”  2009;  “Homemade  Explosives, 
Pyrotechnics,  Rockets  and  More!”  2011).  While  the  simplicity  of  manufacturing  and 
deploying  handheld  IID  makes  them  a  convenient  and  realistic  threat  (Romboy  &  Penrod, 
2011;  Dize,  2011;  Oreg,  n.d.;  “Man  Arrested  in  Marina  del  Rey,”  2011),  attacks  on  large 
road,  rail,  air,  and  marine  transportation  vessels  carrying  flammable  and  other  hazardous 
cargoes  are  also  a  concern  (Peterman,  Elias,  and  Fritelli,  2011;  Jenkins  et  ah,  2010; 
Wheeler,  2006).  The  natural  gas  pipeline  explosion  in  San  Bruno,  California — although 
not  the  result  of  a  terrorist  attack  or  criminal  enterprise — showed  that  even  the  fixed 
transportation  networks  of  hazardous  materials  could  be  exploited  to  create  significant 
fires  (U.S.  Transportation  Security  Administration,  2011;  Lagos,  Fagan,  Cabanatuan,  & 
Berton,  2010).  The  products  that  fuel  U.S.  commerce  also  leave  this  nation  susceptible  to 
improvised  incendiary  attack. 
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The  use  of  IID  is  an  increasing  concern  among  homeland  security  officials, 
particularly  since  the  scale  and  scope  of  the  threat  is  not  well  articulated.  For  his  Center 
for  Homeland  Defenses  and  Security  thesis,  Raynis  (2006)  explored  the  terrorist  use  of 
IID  and  found  that  “the  homeland  security  community’s  intense  concentration  on  the 
threat  posed  by  IEDs  has  caused  it  to  overlook  the  use  of  IIDs  as  potentially  devastating 
terrorist  weapons.  Such  a  preparedness  oversight  has  created  the  kind  of  weakness  that 
terrorists  prey  on”  [sic]  (p.  43).  Additionally,  Raynis  (2006)  described  the  simplicity  with 
which  IID  can  be  created  and  deployed. 

Incendiary  devices  are  easily  improvised  and  are  inexpensive  to  produce. 

The  materials  to  construct  an  IID  are  readily  available  from  any  hardware 
or  grocery  store,  and  are  unlikely  to  invite  suspicion  from  store 
employees.  There  are  many  advantages  to  using  IIDs  as  terrorist  weapons: 
they  require  little  training  to  prepare  and  use.  Overall,  flammable  materials 
are  not  as  volatile  as  explosives;  a  person  using  these  materials  therefore 
does  not  require  the  same  level  of  knowledge  and  experience  as  someone 
handling  explosives,  (p.  36) 

The  Transportation  Security  Administration  (TSA)  (U.S.  Transportation  Security 
Administration,  2008)  stated  that  international  terror  organizations,  affiliated  individuals 
and  like-minded  or  inspired  persons,  had  declared  their  intent  to  employ  IID  against 
targets  in  the  United  States.  According  to  the  report,  “firebombing,  a  simple  and  common 
tactic  among  domestic  terrorists  and  criminals,  could  produce  mass  casualties  and 
destruction,  and  create  intense  fear  and  anxiety  in  the  public.  IIDs  are  generally 
improvised  more  easily  and  are  less  expensive  the  improvised  explosive  devices”  (p.  3). 
Finegan  (2006)  drew  an  even  more  ominous  conclusion,  “ignoring  emerging  threats 
won’t  make  them  go  away.  If  public  safety  officials  apply  lessons  learned  from  threat 
assessment  and  recognize  that  our  enemies  are  reacting  to  our  actions,  they  will  quickly 
realize  that  ignoring  emerging  threats  will  only  embolden  our  enemies  and  make  these 
types  of  attacks  more  likely”  (p.  109). 
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TSA’s  analysis  found  that  incendiary  devices  constructed  and  deployed  with 
strategic  placement  can  cause  damage  even  greater  than  a  similar  sized  explosive  device, 
because  “the  fuel  may  cause  a  rapidly  growing  fire  that  is  difficult  for  first  responders  to 
contain,  causing  an  ever-increasing  amount  of  property  damage  over  time”  (U.S. 
Transportation  Security  Administration,  2008,  p.  5). 

C.  ACCELERANTS 

The  DBT  mentions  that  the  IID  presumed  to  be  used  in  the  arson  scenario 
contains  an  accelerant,  but  like  the  remainder  of  the  scenario,  does  not  describe  it  in 
adequate  detail  to  enable  appropriate  countermeasures  to  be  developed.  In  the  scenario, 
the  accelerant  is  the  first  item  ignited  and  the  predominant  source  of  fuel  anticipated  to 
threaten  the  facility.  While  a  scientific  consensus  for  a  definition  of  an  accelerant  does 
not  exist,  the  NFPA  921  Guide  for  Fire  and  Explosion  Investigations  defines  an 
accelerant  as  “a  fuel  or  oxidizer,  often  an  ignitible  [sic]  liquid,  used  to  initiate  a  fire  or 
increase  the  rate  of  growth  or  spread  of  fire”  (National  Fire  Protection  Association, 
2011).  According  to  Babrauskas  (2003),  accelerants  used  in  incendiary  fires  are  most 
commonly  detennined  by  forensic  analysis  to  be  a  hydrocarbon-based  liquid,  such  as 
gasoline,  kerosene,  paint  thinners,  solvents,  and  similar  products.  In  one  five-year  study, 
he  cited  these  products  were  identified  as  accelerants  in  86.9%  of  debris  samples  testing 
positive  for  accelerants. 

Forensic  analysis  of  fire  debris  for  the  presence  of  accelerants  usually  is 
performed  under  laboratory-controlled  conditions  using  gas  chromatography-mass 
spectrometry,  a  process  that  enables  the  laboratory  technician  to  identify  a  generic 
product  based  on  its  chemical  composition  or  signature.  ASTM  International,  a  world- 
renowned  standards  development  organization,  recognizes  five  test  protocols  for 
identifying  ignitable  liquid  residues  in  fire  debris.  Once  identified,  these  products  may  be 
classified  into  one  of  nine  major  product  categories,  each93  having  three  “weight” 


93  Except  that  the  gasoline  category  includes  gasohol  (Stauffer  &  Lentini,  2003). 
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subcategories  (light,  medium,  and  heavy)  based  on  the  number  of  carbon  atoms94  in  their 
molecular  chain.  Table  27  summarizes  the  ASTM  International  ignitable  liquid 
classification  system,  and  provides  generic  examples  of  some  common  products  (Stauffer 
&  Lentini,  2003).  Most  of  these  products,  in  one  fonn  or  another,  are  available  without 
restriction  on  the  open  market  in  wholesale  or  retail  environments;  thus,  they  are  easily 
accessible  to  both  legitimate  users  and  potential  criminals. 


Table  27.  ASTM  International  Ignitable  Liquid  Classification  System  with  Examples 

(After:  Stauffer  &  Lentini,  2003) 


Class 

Light 

C4  to  C9 

Medium3 

Cs  to  C13 

Heavy 

Cs  to  C20 

Gasoline/Gasohol 

Fresh  gasoline  typically  falls  in  the  range  of  C4-C12 

Petroleum 

distillates 

Petroleum  ether, 
some  cigarette  light 
fluids,  some 
camping  fuels 

Some  charcoal 
starters,  some  paint 
thinners,  some  dry 
cleaning  solvents 

Kerosene,  diesel 
fuel,  some  jet  fuels, 
some  charcoal 
starters 

Isoparaffinic 

products 

Aviation  gas, 
specialty  solvents 

Some  charcoal 
starters,  some  paint 
thinners,  some 
copier  toners 

Some  commercial 
specialty  solvents 

Aromatic  products 

Some  paint  and 
varnish  removers, 
some  automotive 
parts  cleaners, 
xylenes,  toluene- 
based  products 

Some  automotive 
parts  cleaners,  some 
specialty  cleaning 
solvents,  some 
insecticide  vehicles, 
fuel  additives 

Some  insecticide 
vehicles,  some 
industrial  cleaning 
solvents 

Naphthenic 
paraffinic  products 

Cyclohexane  based 
solvents/products 

Some  charcoal 
starters,  some 
insecticide  vehicles, 
some  lamp  oils 

Some  insecticide 
vehicles,  some  lamp 
oils,  industrial 
solvents 

/j-Alkanes 

products 

Solvents,  pentane, 
hexane,  heptane 

Some  candle  oils, 
copier  toners 

Some  candle  oils, 
carbonless  forms, 
copier  toners 

De-aromatized 

distillates 

Some  camping  fuels 

Some  charcoal 
starters,  some  paint 
thinners, 

Some  charcoal 
starters,  odorless 
kerosene 

94  Represented  in  Table  27  as  Cn. 
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Class 

Light 

C4  to  C9 

Medium3 

Cg  to  C13 

Heavy 

Cs  to  C20 

Oxygenated 

solvents 

Alcohols,  ketones, 
some  lacquer 
thinners,  fuel 
additives,  surface 
preparation  solvents 

Some  lacquer 
thinners,  some 
industrial  solvents, 
metal  cleaners/gloss 
removers 

Others- 

miscellaneous 

Single  component 
products,  some 
blended  products, 
some  enamel 
reducers 

Turpentine  products, 
some  blended 
products,  various 
specialty  products 

Some  blended 
products,  some 
specialty  products 

dASTM  E  1618-01  “Standard  Test  Method  for  Ignitable  Liquid  Residues  in  Extracts  from  Fire  Debris 
Samples  by  Gas  Chromatography-Mass  Spectrometry,”  ©2002  permits  variations  if  the  carbon  number 
does  not  fit  neatly  into  a  category  (Stauffer  &  Lentini,  2003,  p.  65). 


The  U.S.  Department  of  Justice,  Bureau  of  Alcohol,  Tobacco,  Firearms  and 
Explosives  (BATFE)  is  authorized  under  the  1982  Anti-Arson  Act95  to  investigate 
explosions  and  fires  if  federal  interest  in  the  event  is  present.  BATFE  may  support  state 
or  local  jurisdictions  in  investigations  depending  upon  the  nature  of  the  target,  victims, 
property  damage  death,  or  injuries  (U.S.  Department  of  Justice,  2006).  Physical  evidence 
collected  by  BATFE  agents  is  submitted  to  its  Laboratory  Services  Division  for  forensic 
analysis.  From  2000  to  2009,  the  Laboratory  Services  Division  analyzed  4,485  fire  debris 
samples,  and  identified  residues  of  ignitable  liquids  in  2,328  exhibits  (A.  Blank  &  R. 
Kuk,  personal  correspondence,  August  3,  2011).  Table  28  provides  the  distribution 
frequency  of  liquids  by  ASTM  classification  for  the  samples  analyzed.  In  nearly  two- 
thirds  of  the  examples,  gasoline/gasohol  products  were  found  in  the  fire  debris,  which 
clearly  makes  it  the  product  of  choice  by  adversaries  intent  on  performing  criminal  acts 
using  accelerants. 


95  See  18U.S.C.  §841. 
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Table  28.  Distribution  Frequency  of  Ignitable  Liquids  in  Federal  Arson  Debris 
Analysis,  2000-2009  (After:  R.  Kuk,  personal  communication,  April  11, 

2011) 


Class 

Positive  Results 
(N=  2,328) 

Percentage 

Gasoline/ Gasohol 

1,455 

62.50 

Petroleum  distillates: 

— 

— 

Light  (C4  to  C9) 

91 

3.91 

Medium  (Cg  to  Cn) 

263 

11.30 

Heavy  (C8  to  C20) 

345 

14.82 

Isoparaffmic  products 

34 

1.46 

Aromatic  products 

130 

5.58 

Naphthenic  paraffinic  products 

24 

1.03 

//-Alkanes  products 

56 

2.41 

De-aromatized  distillates 

— 

- 

Oxygenated  solvents 

123 

5.28 

Others-miscellaneous 

42 

1.80 

The  ignitable  liquid  data  obtained  from  the  BATFE  laboratory  comport  with 
Babrauskas’s  2003  findings  that  hydrocarbon-based  liquids,  such  as  gasoline,  kerosene, 
paint  thinners,  solvents,  and  similar  products,  are  the  most  commonly  used  accelerants. 
The  findings  seem  logical  since  these  products  are  easily  available  to  consumers  in  retail 
outlets  at  which  their  purchase  would  not  raise  undue  suspicion. 

In  a  10-year  study  of  incendiary  devices  used  or  recovered  in  arson  cases 
investigated  in  the  United  States  by  the  BAFTE,  the  U.S.  Bomb  Data  Center  collected 
data  on  1,915  IID  incidents.  Of  those  events,  IID  components,  such  as  containers,  igniters 
or  main  charges,  were  recovered  for  processing  in  38.3%  of  the  cases  (n=735)  and 
containers  were  recovered  in  34.6%  (n=662)  more  cases.  Of  517  containers  with  a 
reported  volume,  77%  were  less  than  64  oz  (1,900  mL)  in  size  with  the  majority  being 
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consumer  beer  or  soda  bottles  of  40  oz  (1,180  mL)  of  less  (J.  Oliver,  personal 
communication,  August  29,  2011).  Table  29  provides  a  breakdown  of  the  container 
volumes  analyzed. 
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Table  29.  Recovered  IID  Container  Volumes  (After:  R.  Kuk,  personal  communication,  April  1 1,  201 1) 


Container 
Volume  (oz) 

Container 
Volume  (mL) 

Number  of 
containers 

%  of  Total  Sample 
(n=662) 

%  of  Known 
Container  Size  (n=517) 

64  or  less 

1900  or  less 

400 

60.4 

77.4 

Not  reported 

Not  reported 

145 

21.9 

NAa 

More  than  64 

More  than  1900 

117 

17.7 

22.6 

Total 

662 

100% 

100% 

dNA=  Not  applicable. 
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The  arson  scenario  in  the  ISC  DBT  describes  a  threat  event  where  an  adversary 
places  an  unidentified  and  non-quantified  IID  containing  an  accelerant  and  utilizing  a 
delay  mechanism  adjacent  to  a  facility.  The  data  provided  by  Babrauskas  and  BATFE 
suggest  the  most  likely  accelerant  used  in  this  scenario  would  be  gasoline  or  another  of 
the  commonly  available  light,  medium,  or  heavy  petroleum  distillates.  However,  the 
quantity  and  condition  remain  undescribed;  is  it  a  handheld  25  oz.  (750  mL)  glass  bottle 
that  has  been  broken  and  spills  its  contents  (e.g.,  a  Molotov  cocktail)  or  is  it  a  large 
gasoline  tanker  truck  with  a  capacity  ranging  from  5,500  to  9,000  U.S.  gallons  (21,000  to 
34,000  L)  that  is  ignited  by  an  incendiary  projectile?  This  information  can  be  significant 
when  conducting  fire  model  analysis  of  a  design  scenario,  because  in  addition  to  the 
latent  heat  of  combustion  of  the  specific  product,  the  amount  and  how  it  is  dispersed 
affects  a  fire’s  HRR.  According  to  Babrauskas  and  Peacock  (1992),  the  HRR  is  the  most 
important  variable  in  predicting  fire  behavior  in  a  compartment.  Table  30  provides  data 
from  the  BATFE  Laboratory  Services  Division  that  compares  the  HRR  at  four  time 
points  following  ignition  (30,  60,  90,  and  120  seconds)  for  different  amounts  and 
distributions  over  different  areas  for  some  gasoline,  kerosene,  and  heptane  samples. 

Tests  were  performed  on  different  volumes  of  igni table  liquids  in  open- top 
vessels  of  differing  size.  The  liquid  depth  in  the  test  apparatus  was  not  specified.  For 
illustration,  all  quantities  in  the  tests  exceeded  50.8  oz.  (1,500  mL),  roughly  equivalent  to 
two  standard  bottles  or  one  magnum  of  wine  found  in  retail  markets.  The  data  are  useful 
to  show  the  differences  in  HRR  for  a  variety  of  volumes  and  configurations;  not  all 
burning  accelerants  emit  energy  at  the  same  rate.  The  ISC  DBT  should  consider  these 
variables  in  its  scenario  criteria.  Of  note  is  that  for  the  configurations  tested,  75%  reached 
their  peak  HRR  between  60  and  90  seconds  following  ignition  before  tending  toward 
extinction,  suggesting  that — barring  ignition  of  other  objects — protective 
countermeasures  should  be  employed  that  will  intervene  early  in  the  fire,  such  as 
automatic  fire  suppression  systems. 
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Table  30.  Heat  Release  Rates  over  Time  for  Varying  Hydrocarbon  Quantities  and  Surface  Areas  (After:  R.  Kuk,  personal 

communication,  April  1 1,  201 1) 


Product 

Gasoline 

Gasoline 

Gasoline 

Gasoline 

Gasoline 

Kerosene 

Kerosene 

Heptane 

Product  volume 

51.5 

64.2 

103.1 

255.9 

206.1 

51.5 

103.1 

64.24 

(oz.) 

(niL) 

1,524 

1,900 

3,048 

7,570.8 

6,096 

1,525 

3,048 

1,900 

Test  size 

113.1 

254.5 

452.3 

452.3 

1809.5 

113.1 

452.3 

254.5 

(sq.  in.)a 

(cm2) 

729.7 

1,641.9 

2,918.1 

2,918.1 

11,674.1 

729.7 

2,918.1 

1,641.9 

Time  from  ignition  (sec.) 

Heat  Release  Rate  in  kW 

30 

70.81 

89.39 

281.97 

307.51 

1,714.11 

34.12 

19.46 

100.46 

60 

67.52 

112.04 

387.00 

422.49 

1,832.02 

45.28 

197.55 

155.81 

90 

72.24 

131.62 

365.77 

526.82 

1,418.55 

53.62 

281.95 

190.02 

120 

70.44 

132.14 

370.63 

517.02 

571.02 

52.55 

308.32 

154.26 

JThe  product  depth  in  the  test  apparatus  was  not  specified. 
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These  BATFE  tests  were  conducted  in  controlled  laboratory  conditions.  The  application 
of  the  test  results  in  the  built  environment  in  which  varying  conditions  exist  for  ground  or 
floor  surfaces,  air  movement,  humidity,  temperature,  building  construction,  and  other 
environmental  factors  that  affect  fire  behavior  should  be  subject  to  additional  study. 

D.  SUMMARY 

Fire’s  use  as  a  weapon  predates  man’s  recorded  history,  and  remains  a  destructive 
force  when  an  adversary  uses  it  to  attack  persons  or  property.  DHS’  ISC  assesses  the 
arson  threat  against  federal  property  to  be  high,  given  the  unsophisticated  nature  of  the 
attack  method,  the  historical  frequency  of  its  use  in  general,  and  specifically,  against 
federal  facilities,  the  availability  of  specific  information  on  planning,  and  the  ease  of 
executing  an  attack.  However,  data  variances  among  the  agencies  responsible  for 
collecting  fire  incident  information  (GSA,  FBI,  FPS,  and  USFA)  in  federal  properties  do 
not  support  the  argument  that  recent  historical  frequency  of  arson  against  federal 
properties  is  statistically  significant.  No  doubt  exists  that  detennined  adversaries  may 
adapt  their  terrorist  or  criminal  tactics  to  include  fire  (Rasmussen  &  Hafez,  2010; 
Balachandran,  2011;  Dolnik,  2007);  however,  the  threat  is  not  well  articulated,  which 
makes  it  impossible  to  design  effective  countermeasures. 

In  those  events  in  which  accelerants  are  used  to  increase  the  rate  of  fire  spread  or 
growth,  the  preferred  materials  appear  to  be  commonly  obtainable  retail  products,  such  as 
gasoline,  kerosene,  or  solvents.  The  type,  volume,  and  dispersion  effects  of  the 
accelerants  can  affect  the  outcome  of  a  fire,  and  should  be  given  thorough  consideration 
in  the  design  of  active  or  passive  countenneasures. 
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VII.  METHOD,  DATA  AND  FINDINGS 


The  development  of  federal  administrative  regulations  is  a  complex  process 
involving  many — and  sometimes  competing — interests.  The  creation  of  the  Physical 
Security  Criteria  for  Federal  Facilities  standard  was  the  work  of  participants  from  more 
than  20  agencies  representing  law  enforcement,  building  construction  and  management, 
security,  diplomacy,  intelligence,  education,  human  health,  finance,  and  environmental 
protection.  Given  the  range  of  professional  disciplines  involved,  traditional  quantitative 
or  qualitative  research  methods  alone  may  not  fully  address  the  breadth,  complexity,  and 
synergy  of  this  effort.  To  get  a  more  complete  picture  to  perform  better  policy  analysis,  a 
variety  of  research  methods  is  desirable. 

The  mixed  method  approach  was  selected  to  dissect  and  evaluate  the  existing 
policies  (the  Physical  Security  Criteria  for  Federal  Facilities  standard  and  its  supporting 
DBT96)  with  the  intent  of  identifying  potential  shortcomings  and  improvements.  Four 
research  methods  were  used  to  build  a  framework  to  assess  the  existing  policy 
documents:  1)  an  appraisal  of  GSA,  FPS,  and  national  fire  and  arson  incident  data,  2)  a 
thematic  content  analysis  of  the  existing  literature  pertinent  to  arson  and  performance 
based  design  practices,  3)  a  Delphi  survey  method  to  fonnulate  a  baseline  arson  scenario, 
and,  4)  the  creation  of  two  virtual  prototypical  federal  buildings,  then  subjecting  both 
designs  to  simulated  fires  using  state-of-the-art  fire  effects  modeling.  A  planned  fifth 
method,  an  online  survey  of  licensed  professional  architects  to  obtain  design  insights, 
returned  so  little  data  as  to  be  worthless.97 

A.  NATIONAL  FIRE  AND  ARSON  INCIDENT  DATA 

Good  policy  is  built  on  a  foundation  of  solid  data.  The  purpose  of  reviewing  fire 
and  arson  infonnation  from  national  incident  databases  was  to  obtain  a  measure  of  the 

99  The  DBT  is  a  separate  ISC  document  that  outlines  3 1  potential  threat  scenarios  against  which 
permanent  countermeasures  ostensibly  can  be  designed,  constructed,  and  evaluated. 

97  A  survey  of  1 18  licensed  architectural  firms  known  to  the  student  researcher  returned  only  10 
responses  for  a  response  rate  of  8.47%,  and  only  seven  respondents  (5.9%)  completed  the  entire  survey. 
Further  research  among  this  target  audience  was  abandoned  after  a  six-week  open  survey  period. 
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number  and  characteristics  of  events  that  occur  in  the  types  of  buildings  normally  owned, 
occupied,  or  used  by  the  federal  government,  and  that  may  be  subject  to  the  Physical 
Security  Criteria  for  Federal  Facilities  standard.  Unfortunately,  the  ability  to  obtain 
unconditional  data  applicable  specifically  to  federal  properties  is  limited  by  the  nature  of 
the  publicly  available  data  sources,  as  well  as  the  inconsistencies  among  the  sources. 

Local  fire  departments  and  fire  marshal’s  offices  are  a  common  source  of  fire 
incident  data.  Due  to  the  longstanding  decentralized  nature  of  fire  services  in  the  United 
States,  until  the  1970s,  no  comprehensive  national  database  of  fire  and  arson  incidents 
existed.  Each  fire  agency  created  and  maintained  its  own  records  management  system;  no 
urgent  need  existed  to  share  data  among  other  organizations.  This  landscape  changed 
somewhat  in  1974  with  the  adoption  of  the  National  Fire  Prevention  and  Control  Act 
(Public  Law  93-498)  that  established  a  National  Fire  Data  Center  (NFDC)  to  collect  and 
analyze  national  fire  and  arson  incident  data  (Ahrens,  Stewart,  &  Cooke,  2003).  The 
USFA  is  home  to  the  NFDC’s  NFIRS,  a  voluntary  data  collection  and  assessment  system. 
The  NFIRS  has  two  objectives,  to  help  state  and  local  governments  develop  fire  reporting 
and  analysis  capability  for  their  own  use,  and  to  obtain  data  that  can  be  used  to  assess 
more  accurately,  and  subsequently,  combat  the  fire  problem  at  a  national  level  (U.S.  Fire 
Administration,  2010a).  NFIRS  collects  details  about  individual  incidents  to  evaluate 
such  factors  as  fire  cause,  structure  type  (e.g.,  dwelling,  school,  factory,  or  office), 
building  construction,  nature  of  the  occupants,  ignition  source,  first  item  ignited,  smoke 
and  fire  spread,  extent  of  damage,  and  performance  of  fire  protection  systems.  This  data 
gives  researchers  a  rich  source  of  infonnation  to  mine  for  both  trends  and  anomalies. 

Approximately  22,000  of  the  nation’s  estimated  27,166  fire  departments  (U.S. 
Fire  Administration,  2006)  report  each  year  through  a  bottom-up  system  in  which  their 
local  fire  incident  data  is  sent  to  a  central  collection  point  within  their  state.  The  state’s 
combined  data  is  scanned  for  errors  and  corrected,  and  the  50  state  agencies  and  the 
District  of  Columbia  submit  their  collated  reports  to  the  USFA’s  NFIRS  national 
database.  Due  to  the  time  it  takes  to  collect  and  process  the  data  from  the  various  sources, 
the  most  recent  data  available  is  from  calendar  year  2009. 
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Similarly,  local  or  state  law  enforcement  agencies  that  may  have  investigatory 
responsibilities  may  voluntarily  submit  their  arson  data  to  the  FBI  through  Uniform 
Crime  Reports  (UCR).  Data  can  be  submitted  in  summary  form  for  the  so-called  Index 
Crimes,98  or  in  detailed  form  in  the  National  Incident-Based  Reporting  System  (NIBRS). 
Approximately  6,400  law  enforcement  agencies  participate  in  NIBRS  and  17,000 
agencies  contribute  Index  Crime  data  to  the  FBI;  however,  because  of  computer 
problems,  changes  in  records  management  systems,  personnel  shortages,  or  a  number  of 
other  reasons,  some  agencies  cannot  provide  data  for  publication  (B.  Pabody,  personal 
communication,  March  27,  2011).  According  to  B.  Pabody  (personal  communication, 
May  1,  2011),  no  correlative  effort  exists  between  the  NFDC  and  UCR  data  sets; 
therefore,  in  some  instances,  data  may  be  duplicative.  Thus,  it  is  unimaginable  to  have 
other  than  a  generic  statistical  picture  of  the  nation’s  arson  problem. 

Another  potential  data  source,  the  non-profit  NFPA,  collects  data  by  sampling 
methods  that  reached  2,790  fire  service  organizations  in  2010  (Karter,  2012).  It  then  uses 
statistical  methods  to  estimate  the  overall  number  of  fires  that  occur  in  the  United  States. 
As  a  matter  of  practice,  NFPA  does  not  analyze  individual  data  submitted  by  fire 
agencies. 

Given  the  data  fields  collected  in  NFIRS,  UCR  or  NIBRS,  it  is  impossible  to 
extract  ownership  information  to  identify  discrete,  federally  owned,  or  occupied 
properties.  Part  of  the  difficulty  occurs  because  federal  buildings  may  be  co-located  with 
privately  owned  real  property,  or  federal  agencies  may  occupy  leased  space.  In  its  most 
recent  inventory  of  non-military  real  property  assets,  the  federal  government  reported  it 
owned  or  leased  3.34  billion  square  feet  (3.1029  x  107m2)  in  429,000  buildings  (Federal 
Real  Property  Council,  2009;  U.S.  General  Services  Administration,  2010b).  To  get  a 
sense  of  the  scale  of  those  combined  holdings,  3.34  billion  square  feet  is  more  than 
60,727  times  the  size  of  The  White  House,  perhaps  the  most  iconic  of  all  federal 
buildings.  Having  the  ability  to  identify  federally  owned  or  occupied  properties  in  the 


98  UCR  Index  Crimes  include  murder  and  non-negligent  manslaughter,  forcible  rape,  robbery, 
aggravated  assault,  burglary,  larceny-theft,  motor  vehicle  theft,  and  arson.  NIBRS  collects  incident  data  on 
33  types  of  offenses. 
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entire  NFIRS  or  NIBRS  databases  would  enhance  the  analytical  value  of  this  study,  but 
absent  the  specific  information,  generalizations  about  fire  and  arson  incidents  must  be 
interpolated  from  the  general  population’s  data,  as  well  as  infonnation  provided  by  the 
GSA  and  the  FPS. 

Unfortunately,  data  provided  by  the  GSA  and  the  FPS  was  incomplete  and 
inconsistent.  According  to  J.  Elvove  (personal  communication,  May  10,  2011),  the  GSA 
does  not  participate  in  the  NFIRS  because  the  fire  service  and  local  government-oriented 
data  NFIRS  produces  is  not  entirely  applicable  to  the  GSA’s  property  management  needs. 
Furthermore,  the  GSA  does  not  have  clear  policies  in  place  that  specify  when  or  by 
whom  fire  incidents  in  their  properties  must  be  reported.  Generally,  if  estimated  property 
damage  from  a  fire  is  less  than  $50,000,  no  report  is  required.  In  some  cases,  according  to 
Elvove,  events  may  be  reported  by  contractors  who  may  have  been  responsible  for  the 
incident  (such  as  electrical  fires  or  fires  caused  by  careless  hot-work  roofing  practices), 
but  no  incentive  exists  for  contractors  to  provide  that  information  candidly.  The  GSA’s 
data  is  current  from  calendar  year  2010.  The  FPS  fire  incident  data  (calendar  year  2010) 
is  statistically  more  detailed — including  counts  for  fires,  false  fire  alarms,  fire  protection 
system  malfunctions,  and  unclassified  events — but  provides  little  substantive  infonnation 
to  enable  a  comprehensive  analysis. 

1.  Fire  Incident  and  Arson  Data 

Table  31  provides  data  comparing  fires  in  federal  and  non- federal  offices  and 
courthouses  for  the  period  from  2007  to  2010.  Table  32  provides  data  comparing  arson 
incidents  in  federal  and  non-federal  offices  and  courthouses  for  the  period  from  2007  to 
2010.  Since  the  data  ranges  collected  from  these  sources  (NFIRS,  GSA  and  FPS)  is 
available  for  only  two  concurrent  years  (2008-2009),  the  ability  to  perfonn  long-tenn 
analysis  is  limited  and  the  data  provides  only  a  general  picture  of  the  fire  and  arson 
problem  in  federal  properties. 
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Table  31.  Fire  Incident  Data  in  Federal/Non-Federal  Offices/Courthouses,  2007-2010  (From:  Federal  property  data  from  J. 

Elvove,  personal  communication.  May  10,  201 1  and  M.  Harney,  personal  communication,  Federal  Protective 
Service,  2011.  All  other  data  from  USFA  National  Fire  Data  Center,  personal  communication,  March  27,  2011) 


Year 

Property  type 

2010 

2009 

2008 

2007 

Total 

Federal  offices 

14 

14 

16 

NRa 

44 

All  other  offices 

NR 

3,852 

4,392 

4,750 

12,994 

Federal  courthouses 

0 

1 

5 

NR 

6 

All  other  courthouses 

NR 

85 

84 

129 

298 

Total 

14 

3,952 

4,497 

4,879 

13,342 

aNR  =  Not  reported. 


Table  32.  Arson  Incident  Data  in  Federal/Non-Federal  Offices/Courthouses,  2007-2010  (From:  Federal  property  data  from  J. 

Elvove,  personal  communication,  May  10,  201 1  and  M.  Hamey,  personal  communication,  Federal  Protective 
Service,  2011.  All  other  data  from  USFA  National  Fire  Data  Center,  personal  communication,  March  27,  2011) 


Year 

Property  type 

2010 

2009 

2008 

2007 

Total 

Federal  offices 

1 

1 

1 

NRa 

3 

All  other  offices 

NR 

190 

235 

247 

672 

Federal  courthouses 

0 

1 

1 

NR 

2 

All  other  courthouses 

NR 

1 

2 

6 

9 

Total 

1 

193 

239 

253 

686 

'NR  =  Not  reported. 
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However,  other  data  from  these  sources  does  help  answer  one  of  the  secondary 
research  questions  of  this  thesis:  “Should  the  Interagency  Security  Committee  reports 
Physical  Security  Criteria  for  Federal  Facilities  and  the  DBT  be  limited  to  criminal  or 
“man  made”  threats  as  stated  in  the  documents?”  Both  documents  state  “other  threats  to 
buildings,  such  as  earthquakes,  fire,  or  storms  are  beyond  the  scope  of  this  document  and 
are  addressed  in  applicable  construction  [and  life  safety]99  standards  .  .  (U.S. 

Department  of  Homeland  Security,  2010a;  U.S.  Department  of  Homeland  Security, 
2010b).  According  to  data  presented  in  Table  2,  Ignition  Sources  for  Fires  in  GSA 
Federal  Facilities  2008-2010,  94.6%  of  the  fires  were  caused  by  sources  other  than 
manmade,  including  cooking,  electrical,  welding  or  cutting,  and  other  or  unclassified. 

Federal  construction  standards — discussed  in  Chapter  VI — since  1988  have 
mandated  compliance  with  model  building  and  fire  codes,  and  since  1996,  have  included 
additional  specifications  for  fire  protection  and  life  safety  in  the  form  of  the  “Facilities 
Standards  for  the  Public  Building  Service  (PI 00).”  The  primary  goal  for  the  Pi 00 
standard  is  to  create  conditions  that  protect  occupants  and  visitors,  while  the  secondary 
goals  are  to  reduce  the  federal  government  and  taxpayers’  potential  losses  from  fire  by 
protecting  real  property,  maintaining  mission  continuity,  and  protecting  the  environment 
(Pi 00  standard,  p.  235).  From  2008  through  2010,  only  two  fire-related  fatalities  have 
been  reported  in  federally  owned  or  managed  properties,  both  of  which  occurred 
February  18,  2010  when  a  small  aircraft  was  flown  into  a  building  containing  an  Internal 
Revenue  Service  office  in  Austin,  Texas  (Brick,  2010).  This  incident  also  was 
responsible  for  13  injuries  (KVUE  and  The  Associated  Press,  2011).  Table  33  shows  the 
distribution  of  fire  deaths  and  injuries  in  federal  and  non-federal  offices  and  courthouses 
for  the  period  2007  through  2010. 


99  The  DBT  adds  “and  life  safety”  to  the  text. 
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Table  33.  Fire  Deaths  and  Injuries  in  Specific  Properties,  2007-2010  (From:  Federal  property  data  from  J.  Elvove,  personal 
communication.  May  10,  2011  and  M.  Hamey,  personal  communication,  Federal  Protective  Service,  2011.  All 
other  data  from  USFA  National  Fire  Data  Center,  personal  communication,  March  27,  2011) 


Year 

2010 

2009 

2008 

2007 

Total 

Property 

type 

Deaths 

Injuries 

Deaths 

Injuries 

Deaths  Injuries 

Deaths 

Injuries 

Deaths 

Injuries 

Federal 

offices 

2 

14 

0 

2 

0 

3 

NRa 

NR 

2 

17 

All  other 
offices 

NR 

NR 

0 

14 

3 

34 

7 

29 

10 

77 

Federal 

courthouses 

0 

0 

0 

0 

0 

0 

NR 

NR 

0 

0 

All  other 
courthouses 

NR 

NR 

0 

1 

0 

0 

0 

6 

0 

7 

Total 

2 

14 

0 

17 

3 

37 

7 

35 

12 

101 

aNR  =  Not  reported. 
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The  secondary  goal,  reducing  property  loss  and  maintaining  continuity  of 
operations,  is  more  difficult  to  quantify  and  is  open  to  vagaries  in  subjective  analysis. 
Historically,  property  fire  losses  are  reported  in  dollar  values  of  direct  and  indirect  loss, 
but  are  not  very  reliable  indicators  of  the  scale  of  an  event.  A  single  room  fire  that 
destroys  an  irreplaceable  computer  system  may  cause  more  direct  and  indirect  monetary 
damage  than  an  entire  warehouse  full  of  printed  government  forms.  Direct  loss  is  the 
measure  of  property  physically  damaged  or  destroyed  during  the  fire  and  fire  control 
efforts.  However,  indirect  loss  includes  intangibles,  such  as  lost  business  opportunities 
and  lost  customers  in  the  private  sector,  and  interruptions  to  operations  or  services  in  the 
public  sector.  “Indirect  loss  could  also  include  dollar  equivalents  for  environmental 
damage  or  damage  to  cultural  heritage,  but  there  is  no  good  data  source  available  on  these 
types  of  indirect  damage”  (Hall,  2010a).  Likewise,  according  to  Ahrens,  Frazier,  and 
Heeschan  (2003),  dollar  estimates  of  property  damage  are  skewed  because  they  involve 
guesswork  or  are  never  reported  to  the  fire  department,  especially  in  the  case  when 
affected  property  owners  are  able  to  handle  the  event  with  on-site  resources.  To  illustrate 
the  wide  variety  of  estimates,  Table  34  shows  the  total  reported  direct  fire  loss  (not 
adjusted  for  inflation)  in  federal  offices  and  courthouses  and  non-federal  offices  and 
courthouses. 
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Table  34.  Estimated  Direct  Property  Loss  Federal/Non-Federal  Offices  and  Courthouses,  2007-2010  (From:  Federal 

property  data  from  J.  Elvove,  personal  communication,  May  10,  201 1  and  M.  Hamey,  personal  communication, 
Federal  Protective  Service,  2011.  All  other  data  from  USFA  National  Fire  Data  Center,  personal  communication, 

March  27,  2011) 


Year 

Property  type 

2010 

2009 

2008 

2007 

Total 

Federal  offices  and 
courthouses 

$3,453,291 

$231,000 

$6,963,295 

NRa 

$10,647,586 

All  other  offices 
and  courthouses 

NR 

$65,675,084 

$79,742,780 

$57,858,791 

$204,276,665 

Total 

$3,453,291 

$65,906,084 

$86,706,075 

$57,858,791 

$214,924,251 

aNR  =  Not  reported. 
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A  less  subjective  measure,  and  one  that  addresses  the  continuity  of  operations 
priorities  of  the  federal  government,  is  the  number  of  incidents  when  the  fire  was 
confined  to  the  room  or  object  of  origin.  This  measure  indicates  the  fire  may  have  self- 
extinguished  before  spreading  to  other  objects,  was  suppressed  in  the  early  stages  by 
human  intervention,  or  an  automatic  fire  suppression  system,  or  the  nature  of  the  passive 
fire  protection  features  (e.g.,  firewalls,  doors,  and  other  compartmenting  features) 
confined  the  fire  and  limited  its  effects.  By  confining  the  fire  to  the  object  or  room  of 
origin,  less  collateral  damage  occurs  and  a  greater  likelihood  exists  that  operations  can 
return  to  normal  more  quickly  once  the  damage  has  been  repaired.  Table  35  identifies  the 
number  of  fires  in  federal  and  non-federal  properties  when  the  incident  was  confined  to 
the  object  or  room  of  origin. 

Table  35.  Fire  Incidents  where  Fire  Confined  to  Object  or  Room  of  Origin,  2007-2010 
(From:  Federal  property  from  J.  Elvove,  personal  communication,  May  10, 
2011.  All  other  data  from  USFA  National  Fire  Data  Center,  personal 

communication,  2011) 


Year 

Property  type 

2010 

2009 

2008 

2007 

Total 

Federal  offices 

11 

13 

15 

NRa 

39 

All  other  offices 

NR 

623 

928 

888 

2,439 

Federal  courthouses 

0 

1 

1 

NR 

2 

All  other  courthouses 

NR 

18 

19 

13 

24 

Total 

644 

959 

897 

2,510 

aNR  =  Not  reported. 


When  looking  at  these  numbers  as  a  percentage  to  total  events  (see  Table  36),  it  is 
apparent  that  the  outcome  of  fires  in  federal  offices  and  courthouses  is  superior  to  that  of 
non-federal  properties.  Fires  that  occur  in  federal  buildings  are  more  than  four  times  more 
likely  to  be  confined  to  the  object  or  room  of  origin  than  in  non-federal  properties. 
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Table  36.  Percentage  of  Incidents  Where  Fire  Confined  to  Object  or  Room  of  Origin, 
2007-2010  (From:  Federal  property  from  J.  Elvove,  personal 
communication,  May  10,  201 1.  All  other  data  from  USFA  National  Fire  Data 
Center,  personal  communication,  2011) 


Year 

Property  type 

2010 

2009 

2008 

2007 

Median 

Federal  offices 

71.5 

92.8 

93.7 

NRa 

86.4 

All  other  offices 

NR 

16.2 

21.1 

18.7 

18.8 

Federal  courthouses 

0 

100.0 

20.0 

NR 

33.3 

All  other  courthouses 

NR 

21.4 

22.4 

2.3 

8.1 

aNR  =  Not  reported. 


Additional  research  is  warranted  to  explain  this  disparity  over  what  factors  are 
influencing  the  outcomes100  between  federal  and  non-federal  properties,  but  given  the 
comparative  success  of  containing  fires  to  the  object  or  room  of  origin  in  conjunction 
with  the  preponderance  of  accidental  ignition  sources  in  federal  buildings,101  it  appears 
the  “applicable  construction  [and  life  safety]  standards”  cited  in  the  Physical  Security 
Criteria  for  Federal  Facilities  and  the  DBT  are  adequate  to  satisfy  the  primary  goal  of 
life  safety  and  the  secondary  goals  of  property  protection  and  environmental  controls. 

B.  THEMATIC  CONTENT  ANALYSIS  OF  THE  RECENT  LITERATURE 

Boote  and  Beile  (2005)  emphasized  the  importance  of  the  literature  review  as  a 
research  method  because  it  advances  collective  understanding  about  the  particular  topic 
being  studied,  and  to  enhance  that  collective  understanding  an  analysis  of  what  has  been 
written  previously  is  required.  The  literature  review  is  the  foundation  of  any  research 
project  to  frame  its  context,  clearly  demarcates  what  is  and  what  is  not  within  the  scope 
of  study,  and  justifies  the  reasons  for  the  structure  (Boote  &  Beile,  2005).  In  addition, 


100  Among  others,  factors  could  include  the  existence  of  automatic  fire  detection  and  suppression 
systems,  fire  resistive  construction  with  automatic  opening  protectives  (e.g.,  fire  doors  and  dampers), 
aggressive  enforcement  of  safety  rules  and  regulations,  employee  continuing  training  and  education,  or  a 
cultural  commitment  to  maintaining  a  safe  working  environment. 

101  Only  5.4%  of  fire  incidents  were  classified  as  malicious. 
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Leedy  and  Ormrod  (2010)  reported  that  a  review  of  the  literature  on  a  particular  topic  is 
helpful  as  its  own  analytical  tool  to  interpret  the  results  of  an  individuals’  study  and  relate 
them  to  what  is  already  known  about  the  matter  being  researched. 

The  purpose  of  conducting  a  literature  review  for  this  study  was  to  assess  whether 
the  perfonnance-based  design  methods  could  be  employed  as  effective  arson 
countenneasures,  and  whether  the  design  criteria  published  by  the  SFPE  and  ICC  might 
be  transferable  to  the  Physical  Security  Criteria  for  Federal  Facilities  standard  to  answer 
the  primary  and  secondary  research  questions. 

A  thematic,  open-ended  content  analysis  approach  was  used  to  assess  the  current 
perspective  of  the  literature  on  performance-based  design  and  its  application  to  arson  or 
incendiary  scenarios.  A  non-probabilistic  sample  (N  =  150)  of  professional  journals  and 
other  sources  pertinent  to  building  construction  was  selected,  and  keyword  searches  were 
conducted  on  one  or  more  combinations  of  the  following  terms:  building  construction, 
building  codes,  performance-based  design,  perfonnance-based  codes,  fire  safety,  arson, 
and  incendiary.  Both  a  priori102  and  emergent  coding  were  employed.  A  priori  coding 
was  used  to  identify  the  literature  source,  publication  year,  geographical  source,103  and 
fundamental  yes/no  decisions.  Emergent  coding  evolved  early  in  the  literature  review  to 
deduce  the  key  criteria  authors  assigned  that  described  success  or  failure  in  their  findings. 
A  single  coder  was  used  in  the  literature  search.  (See  Appendix  D  for  the  content  analysis 
codebook). 

1.  Arson  Threats  Reported  in  Performance-Based  Design  Literature 

The  search  showed  that  arson  threats  were  mentioned  in  66.7%  (n=100)  of  the 
literature  pertinent  to  performance-based  design  and  fire  scenarios,  including  studies  that 
evaluated  entire  building  projects  or  sub-components,  such  as  fire-resistive  construction 
elements  (e.g.,  structural  steel,  fire  separations,  or  fire  protection  systems).  In  68.7% 
(n=103)  of  the  literature,  the  use  of  performance-based  design  was  mentioned  as  a  means 

102  Category  codes  selected  before  coding  began. 

103  Some  articles  were  pertinent  to  specific  countries;  others  were  generic  to  the  engineering  discipline 
and  practice  of  performance-based  design. 
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to  craft  a  viable  mitigating  solution  against  incendiary  fires.  However,  substantially  fewer 
of  the  articles  evaluated  potential  results  from  the  use  of  performance-based  design 
solutions.  Table  37  describes  the  number  of  instances  in  which  the  potential  outcome  of 
the  perfonnance-based  design  option  was  not  addressed  in  the  article,  or  was  detennined 
to  be  an  unsuitable,  suitable,  or  situation  dependent  option. 

Table  37.  Perfonnance-based  Design  Arson  Mitigation  Suitability  Assessment 


n 

% 

Not  addressed/no  assessment  made 

102 

68.0 

Unsuitable 

14 

9.3 

Suitable 

10 

6.7 

Situation  dependent 

24 

16.0 

Total 

150 

100.0 

In  the  48  instances  in  which  an  assessment  was  made  regarding  the  suitability  of 
perfonnance-based  design  solutions,  one  theme  emerged  as  the  predominant  factor  in  the 
method’s  success  or  failure,  accurate  description  and  quantification  of  the  design  fire 
scenario.  The  accuracy  of  the  design  fire  scenario(s)  was  mentioned  as  a  critical 
consideration  in  34  of  the  48  articles  (70.8%)  where  the  efficacy  of  perfonnance-based 
design  solutions  was  discussed,  and  was  overwhelming  cited  (83.3%,  n=20)  in  the  24 
cases  in  which  the  suitability  of  performance-based  design  was  deemed  to  be  situation 
dependent.  Other  thematic  issues  identified  in  the  literature  included  whether  adequate 
risk  assessments  were  included  in  the  design  proposal  (e.g.,  quantification  of  the  arson 
threat),  the  computational  power  and  accuracy  of  the  fire  models  to  mimic  complex  real 
world  conditions,  the  competency  of  the  design  professionals  to  interpret  the  data,  and 
other  miscellaneous  factors.  The  results  are  included  in  Table  38. 
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Table  38.  Factors  Influencing  Suitability  of  Performance  Based  Design  as  an  Arson 

Countenneasure 


Factor 

n 

% 

Design  fire  scenario(s)a 

34 

70.8 

Adequate  risk  assessments 

5 

10.4 

Capability  of  computational  tools 

4 

8.3 

User  competency 

3 

6.3 

Other 

2 

4.2 

Total 

48 

100.0 

Note.  Where  more  than  one  factor  was  mentioned,  a  simple  word  count  was 
employed  to  determine  which  factor  was  given  primacy  by  the  author. 
aThree  articles  used  examples  of  multiple,  simultaneous  design  fires  in  their 
analysis. 

Thirty-four  authors  who  discussed  a  well-defined  design  fire  scenario  stressed  its 
importance,  and  their  critical  criteria  varied  depending  upon  the  topic  of  the  article. 
Eleven  (32.4%)  specifically  mentioned  the  importance  of  having  accurate  HRR  data  to 
use  in  fire  modeling  analysis.  Others  employed  vague  descriptions,  such  as 
“quantification  of  the  arson  scenario,”  “incomplete  scenario  development,”  “scenario 
definition,”  or  “keep  fire  scenarios  within  range  of  acceptable  values,”  to  express  the 
need  for  accurate  data  input. 

2.  References  to  International  Design  Documents 

Interestingly,  given  the  SFPE’s  international  membership  and  advocacy  on  behalf 
of  perfonnance-based  design,  its  SFPE  Engineering  Guide  to  Performance  Based  Fire 
Protection  was  mentioned  in  only  one  (0.7%)  of  the  literature  examples  pertaining  to 
arson  and  perfonnance-based  design  reviewed.104  Likewise,  the  ICC’s  Performance 


104  The  first  edition  of  the  SFPE  guide  was  published  in  2000.  Fourteen  of  the  articles  reviewed 
(9.4%)  were  written  in  1999  or  2000;  therefore,  the  authors  may  not  have  been  aware  of  this  document. 
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Code  for  Buildings  and  Facilities  was  mentioned  in  a  single  article,  a  doctoral  thesis 
regarding  the  application  of  systemic  dynamics  to  building  simulation  for  anti-terrorism 
resource  allocation  (Thompson,  2009). 

Two  other  documents,  NFPA  101,  Life  Safety  Code  and  NFPA  5000  Building 
Construction  and  Safety  Code,  were  referenced  in  seven  and  two  articles,  respectively. 
These  codes  pennit  perfonnance-based  design  options  as  alternatives  to  prescriptive 
regulations.  Both  codes  employ  the  eight  design  fire  scenarios  of  Table  16,  Design  Fire 
Scenarios  from  NFPA  101,  Life  Safety  Code.  Scenario  2,  “an  ultra-fast  developing  fire, 
in  the  primary  means  of  egress,  with  interior  doors  open  at  the  start  of  the  fire”  arguably 
is  an  arson  scenario  that,  according  to  the  NFPA  code  and  its  annex,  uses  gasoline 
(National  Fire  Protection  Association,  2012).  This  scenario  also  is  employed  in  the  New 
Zealand  building  codes  to  protect  occupants  from  intentionally  set  or  accidental  fires 
starting  in  a  means  of  egress  (New  Zealand  Ministry  of  Business,  Innovation  and 
Employment,  2012). 

C.  BASELINE  DESIGN  FIRE  SCENARIO  SELECTION 

To  obtain  a  more  realistic  and  quantitative  baseline  arson  scenario  than  that 
described  in  the  DBT,  a  group  of  expert  fire  investigators  was  polled  using  the  Delphi 
Method.  The  Delphi  Method  is  an  iterative  process  to  collect  and  distill  anonymous 
judgment  from  experts  using  a  series  of  data  collection  techniques  and  feedback 
instruments  (Skulmoski,  Hartman,  &  Krahn,  2007).  The  technique  allows  the  researcher 
to  pose  open-  and  closed-ended  questions  regarding  the  topic  at  hand  to  a  group  of 
subject  matter  experts.  Anonymity  in  the  process  allows  the  participants  to  express  their 
opinions  freely  without  being  influenced  by  other  respondents  or  the  researcher  (Rowe  & 
Wright,  1999).  When  the  initial  data  is  collected,  the  researcher  analyzes  the  results  using 
qualitative  coding  or  statistical  summaries  to  identify  commonalities  and  trends  among 
the  responses.  Upon  completion  of  the  initial  analysis,  participants  complete  a  second 
survey  based  on  the  first  round  results,  and  that  survey  also  is  analyzed  using  the 
qualitative  or  statistical  method.  Generally,  a  third  round  of  surveys  is  the  final  step 
employed  in  the  Delphi  approach. 
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The  baseline  design  fire  scenario  Delphi  approach  employed  four  main  steps: 
developing  the  questionnaire,  selecting  participants,  administering  the  three-round 
survey,  and  analyzing  the  results.  One  part  of  the  first  round  questionnaire  was  used  to 
establish  the  participants’  expert  credentials,  and  the  second  part  was  to  survey  their 
perception  of  the  likelihood  of  the  arson  scenario  published  in  the  DBT. 

While  the  word  “expert”  is  subjective,  in  criminal  cases,  the  presiding  judge 
qualifies  expert  witnesses  individually  after  a  review  of  the  witness’s  credentials. 
According  to  the  Advisory  Committee  on  Rules,  Rule  702  of  the  Federal  Rules  of 
Evidence  states: 

The  fields  of  knowledge  which  may  be  drawn  upon  are  not  limited  merely 
to  the  “scientific”  and  “technical”  but  extend  to  all  “specialized” 
knowledge.  Similarly,  the  expert  is  viewed,  not  in  a  narrow  sense,  but  as  a 
person  qualified  by  “knowledge,  skill,  experience,  training  or  education.” 

Thus  within  the  scope  of  the  rule  are  not  only  experts  in  the  strictest  sense 
of  the  word,  e.g.,  physicians,  physicists,  and  architects,  but  also  the  large 
group  sometimes  called  “skilled”  witnesses,  such  as  bankers  or 
landowners  testifying  to  land  values.  (Legal  Information  Institute,  2011b) 
[Electronic  edition]. 

For  example,  in  one  study  of  693  federal  and  state  criminal  appellate  court  cases  over  an 
1 1-year  period,  Groscup,  Penrod,  Studebaker,  Huss,  and  O’Neil  (2002)  found  that  98%  of 
the  experts  who  testified  derived  some  of  their  expertise  from  experience,  74.8%  derived 
some  expertise  from  case  specific  experience,  and  62%  derived  their  expertise  through 
education.  Many  experts  accumulated  their  expertise  from  more  than  one  or  all  of  the 
sources. 

Given  that  expertise  is  aggregated  from  experience  and  education,  a  12-question 
survey  was  developed  to  assess  respondents’  credentials  in  these  realms  before  asking 
their  suggestions  to  develop  a  realistic  and  quantitative  baseline  arson  scenario.  Tables  39 
through  41  list  the  questions  and  responses  used  to  establish  expertise.  Survey  subjects 
were  40  volunteer  adult  students  recruited  from  the  Fire/Arson  Origin  and  Cause 
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Investigations  and  Interviewing  and  Interrogation  Techniques 105  courses  at  the  USFA 
National  Fire  Academy  (NFA)  in  Emmitsburg,  Maryland.  Students  who  attend  the  NFA 
represent  federal,  state,  or  local  government  entities  responsible  for  fire  protection  and 
post-incident  investigation.  All  students  must  meet  minimum  academic  criteria  and 
prerequisites,  and  have  the  approval  of  their  agency’s  senior  executive  to  attend  the 
courses.  Students  who  meet  the  minimum  criteria  are  selected  randomly  by  postal  zip 
code  to  enhance  geographic  diversity  in  the  classroom.  To  recruit  the  volunteer 
participants,  a  classroom  instructor  not  acquainted  with  this  thesis  read  aloud  a  recruiting 
message  summarizing  the  nature  and  purpose  of  the  study.  Subjects  were  invited  to 
volunteer  their  participation  by  proving  an  email  address  of  their  choice  to  which  the 
survey  instruments  were  delivered.  While  some  students  opted  to  use  work  email 
addresses  in  the  fonnat  firstname.lastname@jurisdictionaddress  whereby  they  potentially 
could  be  identified,  others  provided  personal  email  addresses  with  no  identifying 
characteristics.  In  any  case,  other  than  the  email  solicitation  to  participate  in  the  Delphi 
surveys,  the  student  researcher  had  no  contact  with  the  subjects  to  permit  their  anonymity 
as  much  as  reasonably  possible. 

Questions  related  to  subject  experience  with  detennining  the  origin  and  cause  of 
various  fires  were  derived  from  National  Fire  Protection  Association  921,  Guide  for  Fire 
and  Explosion  Investigations,  where: 

Accidental  fires  involve  all  those  for  which  the  proven  cause  does  not 
involve  an  intentional  human  act  to  ignite  or  spread  fire  into  an  area  where 
the  fire  should  not  be;  natural  fire  causes  involve  fires  caused  without 
direct  human  intervention  or  action,  such  as  fires  resulting  from  lightning, 
earthquake,  and  wind;  [and]  an  incendiary  fire  is  one  intentionally  ignited 
under  circumstances  in  which  the  person  igniting  the  fire  knows  the  fire 
should  not  be  ignited.  (National  Fire  Protection  Association,  2011,  p.  19- 
1) 


105  The  courses  address  the  technical  and  scientific  knowledge  and  skills  needed  to  conduct  successful 
fire/arson  investigations.  Methods  are  demonstrated  for  conducting  legal  fire  investigations  that  culminate, 
when  appropriate,  in  prosecution  for  arson.  Upon  the  completion  of  the  courses,  the  students  are  expected 
to  identify  the  origin  and  cause  of  a  fire,  conduct  a  technically  and  legally  sound  investigation,  and  pursue 
the  case  through  the  judicial  system  (U.S.  Fire  Administration,  2011). 
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The  three-round  survey  was  conducted  between  October  21  and  January  14, 
20  1  2. 106  In  each  round,  subjects  were  provided  an  email  invitation  to  participate  in  the 
online  survey.  Forty  subjects  were  invited  to  participate  in  the  first  round  of  the  survey, 
with  a  response  rate  of  55%  (N=22).  One  respondent  opted  not  to  participate  in  the  study, 
and  three  others  did  not  complete  all  the  data  fields,107  which  left  18  respondents  (45%  of 
those  invited)  to  supply  the  data.  Table  39,  Survey  Subjects’  Academic  Credentials, 
summarizes  the  respondents’  academic  qualifications.  Table  40,  Survey  Subjects’ 
Professional  Certifications,  identifies  the  professional  certificates  they  possess. 


Table  39.  Survey  Subjects’  Academic  Credentials 


Some 

high 

school 

High 

School 

Trade 

School 

No 

Associates  Bachelors  Masters  Doctorate  Response 

What  is  the 
highest  level 
of  education 
you  have 
received? 

0 

2 

2 

2  7  6  1  1 

Note.  N  =  21 

Table  40. 

Survey  Subjects’  Professional  Certifications 

n 

None  9 


International  Association  of  Arson  Investigators  1 0 

National  Association  of  Fire  Investigators  1 

U.S.  Department  of  Justice  Bureau  of  Alcohol,  Tobacco,  Firearms  and  Explosives  0 

Other  0 

Note.  N=19.  Total  equals  20  because  one  respondent  possesses  two  certifications. 


100  Authorized  by  Naval  Postgraduate  School  Institutional  Review  Board  Protocol  number 
NPS.2012.0002-IR-EP7-A. 

107  Two  of  the  three  who  did  not  complete  the  entire  survey  answered  questions  pertaining  to  their 
educational  level  and  certifications. 
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Table  41,  Survey  Results:  Expert  Qualifications,  reveals  a  significant  variation  in 
experiential  skills  among  the  survey  population  in  the  number  of  structure  fires 
investigated  and  the  number  of  times  the  cause  of  those  fires  was  detennined  to  be 
accidental.  Given  the  small  sampling  population,  two  respondents  who  reported  they  had 
reported  between  1,500  and  2,000  fires  each  heavily  skew  the  data.  Regardless,  the  data 
shows  the  respondents  are  well  educated  (71.4%  possess  at  least  a  bachelor’s  level 
degree),  have  an  average  of  9.05  years  of  experience  in  fire  investigation,  approximately 
half  have  been  professionally  credentialed,  and  have  investigated  an  estimated  252.05 
fires  each  during  their  careers. 
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Table  4 1 .  Survey  Results:  Expert  Qualifications 


Question 

Mean 

SDa 

Median 

Mode 

Range 

How  many  years  of  fire  and  arson  investigation  experience  do  you  have? 

9.05 

8.27 

5 

4 

29 

What  is  the  number  of  fire  and  arson  investigation  in-service  training  programs  you  have 
attended?  (This  category  includes  local,  state,  national  or  professional  association  training 
programs  and  seminars  where  an  educational  or  training  component  was  included.) 

28.55 

59.91 

15 

30 

262 

What  is  the  estimated  number  of  structure  fires  of  all  types  you  have  investigated? 

252.05 

355.35 

112.5 

300 

1994 

Of  the  total  number  of  fires  you  have  investigated,  what  is  the  estimated  number  of 
incendiary  fires  you  have  investigated? 

46.64 

96.33 

25 

300 

299 

What  is  the  estimated  number  of  times  you  have  determined  origin  and  cause  of  fires  that 
were  classified  as  accidental? 

99.5 

240.34 

50 

50 

995 

What  is  the  estimated  number  of  times  you  have  determined  origin  and  cause  of  fires  that 
were  classified  as  natural? 

8.73 

25.88 

2 

0 

100 

What  is  the  estimated  number  of  times  you  have  determined  origin  and  cause  of  fires  that 
were  classified  as  incendiary? 

29.77 

75.45 

12.5 

50 

300 

What  is  the  estimated  number  of  times  you  have  given  sworn  testimony  related  to  fire  and 
arson  investigation,  including  depositions  and  courtroom  appearances? 

19.18 

9.79 

3 

0 

300 

What  is  the  number  of  times  you  have  been  qualified  as  a  fire  investigation  expert  in  state 
court? 

1.59 

1.12 

0 

0 

25 

What  is  the  number  of  times  you  have  been  qualified  as  a  fire  investigation  expert  in 
federal  court? 

1.41 

0.86 

0 

0 

25 

aSD  =  Standard  deviation 
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In  addition  to  establishing  their  credentials,  in  the  first  round  participants  were 
asked108  to  respond  to  a  single  closed-ended  question  and  were  given  the  opportunity  to 
submit  responses  to  two  open-ended  questions.  The  closed-ended  question  was  captured 
from  the  DBT  and  employed  a  Likert  score  to  measure  responses.  The  closed-ended 
question  was  “In  your  opinion,  how  likely  is  the  following  arson  scenario?”  and  the 
description  was  that  found  in  the  DBT:  “An  adversary  places  an  improvised  incendiary 
device  (IID)  containing  an  accelerant  and  utilizing  a  delay  mechanism  adjacent  to  a 
facility,  but  outside  the  view  of  security  countermeasures.”  Ordinal  response  options 
included  Don’t  Know,  Highly  Unlikely,  Unlikely,  Neutral/No  Opinion,  Likely,  and 
Highly  Likely,  with  corresponding  scoring  values  ranging  from  0  (zero)  to  5  .  Table  42 
summarizes  the  responses  from  the  1 8  persons  who  completed  the  survey. 

Table  42.  Responses:  Likelihood  of  Design  Basis  Threat  Arson  Scenario 


Response  Option 

Responses 

% 

Highly  Likely 

3 

16.7 

Likely 

5 

27.8 

Neutral/No  Opinion 

2 

11.1 

Unlikely 

5 

27.8 

Highly  Unlikely 

2 

11.1 

Don’t  Know 

1 

5.6 

Total 

18 

100 

108  Using  SurveyMonkey.com. 
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The  distribution  of  the  results  shows  that  respondents  were  equally  divided 
between  the  scenario  being  unlikely  or  likely,  with  a  small  percentage  (16.7%,  n=3) 
reporting  the  scenario  to  be  highly  likely. 

In  the  open-ended  questions,  respondents  were  asked  to  complete  the  following 
narratives. 

•  Describe  what  you  believe  are  likely  or  highly  likely  arson  scenarios 
involving  non-military  and  non-postal  federal  buildings  or  facilities 

•  For  your  scenario(s),  describe  what  you  believe  would  be  the  first  item  or 
items  ignited  by  the  perpetrator 

The  narrative  responses  were  analyzed  for  key  themes  and  words  that  resulted  in 
the  following  nine  closed-ended  and  one  open-ended  question  for  the  second  round  of  the 
Delphi  analysis.  Table  43,  Second  Round  Results:  Subject-Suggested  Arson  Scenarios, 
shows  the  nine  closed-ended  questions  and  responses.  Respondents  were  asked  to  employ 
Likert  techniques,  and  ordinal  response  options  included  No  Answer,  Highly  Unlikely, 
Unlikely,  Likely,  and  Highly  Likely,  with  corresponding  scoring  values  ranging  from  0  to 
4.  The  frequency  of  each  response  was  multiplied  by  the  assigned  scoring  value,  and  the 
sum  divided  by  the  number  of  respondents  to  obtain  the  mean.  The  response  rate  to  the 
second  round  of  the  survey  was  35%  (n=14),  down  four  respondents  from  the  first  round. 
Table  43  summarizes  their  responses  and  ranks  them  according  to  the  distribution  of 
results.  Table  44,  Second  Round  Results:  Item  Most  Likely  Ignited  First,  presents  the 
respondents’  data  on  the  eight  items  they  suggested  would  be  the  most  likely  ignited  first 
by  an  adversary  to  result  in  a  fire.  In  this  table,  the  options  were  cloth  or  fabric, 
combustible  container,  ignitable  liquid,  light  bulb  filament,  makeshift  materials  (garbage, 
rubbish,  waste  paper),  paper  or  cardboard,  a  road  flare,  or  other.  Respondents  were  asked 
to  rank  them  from  1  to  8,  with  “1”  representing  the  most  likely  item  first  ignited,  and  “8” 
being  the  least  likely  item  first  ignited  by  an  adversary.  In  Table  44,  a  lower  mean  value 
represents  a  higher  likelihood  of  occurrence. 
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Table  43.  Second  Round  Results:  Subject- Suggested  Arson  Scenarios 


Question 

Mean 

SDa 

Median 

Mode 

Rank 

An  adversary,  who  is  an  agency  employee,  starts  a  fire. 

3.0000 

11.46 

1 

1 

1 

An  adversary  uses  liquid  accelerants  on  the  outside  of  the  building. 

2.9286 

11.10 

2 

0 

2 

An  adversary  breaks  a  window  and  ignites  burnable  materials  that  can  be  reached 
inside. 

2.8585 

8.70 

3 

3 

3 

An  adversary  uses  a  Molotov  cocktail  thrown  through  the  window  or  store  front. 

2.8571 

8.69 

3 

3 

4 

An  adversary  hand-deploys  incendiary  devices  (e.g.,  Molotov  cocktail)  at  facilities 
with  unsecured  pedestrian  access  (sidewalks). 

2.6429 

7.27 

2 

0 

5 

An  adversary  breaks  in  and  uses  flammable  liquids  as  an  accelerant. 

2.5000 

11.45 

2 

0 

6 

An  adversary  places  an  incendiary  fire  ignition  device  around  an 
accessible/unsecured  perimeter. 

2.2857 

5.86 

2 

1 

7 

An  adversary  places  the  incendiary  device  in  a  mail  box,  homeless  persons’  cart  or 
bags,  waste  basket  attached  to  poles. 

2.0714 

4.61 

2 

2 

8 

An  adversary  ignites  a  portable  toilet  with  a  road  flare,  which  ignites  the  adjacent 
building. 

1.6428 

6.62 

1 

1 

9 

aSD=  Standard  deviation 
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Table  44.  Second  Round  Results:  Item  Most  Likely  Ignited  First 


Item  Most  Likely  Ignited  First 

Mean 

SDa 

Median 

Mode 

Rank 

Ignitable  liquid 

1.86 

1.29 

1 

1 

1 

Paper,  cardboard 

2.71 

1.14 

2.5 

4 

2 

Makeshift  materials  (garbage,  rubbish,  waste 
paper) 

3.08 

1.31 

3 

3 

3 

Cloth  or  fabric 

3.92 

1.56 

4 

5 

4 

Combustible  container 

4.36 

1.57 

5 

5 

5 

Road  flare 

5.92 

1.56 

6.5 

7 

6 

Other 

6.29 

2.43 

8 

8 

7 

Light  bulb  filament 

7.00 

1.04 

7 

8 

8 

Note.  “Other”  responses  included  “vehicle,”  “incendiary  device,”  and  “furnishings  i.e.,  bedding,  sofa, 
overstuffed  chair,  love  seat.” 
aSD=Standard  deviation 


For  the  final  round,  the  top  three  results  from  round  two  were  submitted  to  the 
survey  subjects.  The  final  round  response  rate  was  42.5%  (n=17).  Tables  45  and  46 
present  the  final  data  from  the  experts  surveyed.  According  to  their  opinions,  the  most 
likely  arson  scenario  in  federal  buildings  or  facilities  is  one  in  which  an  adversary  breaks 
a  window  for  entry,  and  using  makeshift  materials  found  on  the  premises,  ignites  a  fire. 


Table  45.  Final  Round  Results:  Subject-Suggested  Arson  Scenarios 


Question 

Mean 

SDa 

Median 

Mode 

Rank 

An  adversary  breaks  a  window  and  ignites  burnable 
materials  that  can  be  reached  inside. 

2.15 

0.69 

2 

2 

1 

An  adversary,  who  is  an  agency  employee,  starts  a 
fire. 

1.87 

0.99 

1 

1 

2 

An  adversary  uses  liquid  accelerants  on  the  outside 
of  the  building. 

1.85 

0.80 

2 

1 

3 

aSD=Standard  deviation 
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Table  46.  Final  Round  Results:  Item  Most  Likely  Ignited  First 


Item  Most  Likely  Ignited  First 

Mean 

SDa 

Median 

Mode 

Rank 

Makeshift  materials  (garbage,  rubbish, 
waste  paper) 

2.46 

0.78 

3 

3 

1 

Ignitable  liquid 

1.73 

0.80 

2 

1 

2 

Paper,  cardboard 

1.58 

0.67 

1.5 

1 

3 

aSD=Standard  deviation 


While  the  experts  rejected  the  idea  from  the  ISC  DBT  arson  scenario  that  an 
accelerant  and  delay  mechanism  are  important  components  of  an  adversary’s  IID,  their 
conclusion  that  the  attack  is  likely  to  occur  along  an  architectural  plane  containing  a 
window  suggests  that  improved  perimeter  security  would  reduce  the  likelihood  of  a 
successful  arson  attack.  The  ISC  DBT  arson  scenario  was  qualified  by  its  creators  that  an 
arson  attack  would  occur  “outside  the  view  of  security  countermeasures”  (U.S. 
Department  of  Homeland  Security,  2010b,  p.  7.2.1).  Additional  research  on  the  efficacy 
of  perimeter  security  countenneasures  may  yield  data  recommending  added  protection 
from  adversaries  through  enhanced  human,  visual,  kinetic,  or  other  technological  security 
regimes. 

D.  FIRE  EFFECTS  MODELING  APPLICATION 

Fire  is  a  dynamic  phenomenon  influenced  by  complex  chemical,  physical,  and 
environmental  factors.  To  study  its  effects  under  a  variety  of  conditions  without 
conducting  full-scale  destructive  fire  tests,  fire  research  scientists  and  engineers  have 
developed  computerized  mathematical  fire  models  to  simulate  the  effects  of  fire  behavior 
in  a  virtual  environment.  According  to  Phillips  (1995),  “simulation  models  are  widely 
used  in  science,  engineering  and  mathematics  in  the  study  of  problems  that  involve 
ordinary  and  partial  differential  equations  (either  overtly  or  implicitly)”  (p.  5-1).  In  fire 
science  and  fire  protection  engineering,  models  can  be  used  to  simulate  fire  behavior, 
smoke  migration,  absorption  of  toxic  products,  human  movement  in  response  to 
threatening  events,  and  the  perfonnance  of  fire  protection  systems. 
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Beyler  and  DiNenno  (2003)  reported  that  mathematical  fire  models  could  be 
classified  as  either  probabilistic  or  deterministic.  They  found  that 

probabilistic  models  attempt  to  deal  with  the  random  nature  of  fire 
behavior,  whereas  deterministic  models  presume  that,  given  a  well-defined 
physical  situation,  fire  growth  and  behavior  is  entirely  detennined.  Both 
approaches  are  valuable  in  understanding  fire.  (p.  3-70) 

Within  the  deterministic  framework,  two  major  categories  of  fire  models  are 
recognized  throughout  the  fire  protection  community.  The  first  is  known  as  a  zone  model, 
in  which  the  room  or  compartment  being  modeled  is  divided  into  two  regions  or  zones. 
The  upper  portion  of  the  compartment  is  assumed  to  be  filled  with  hot  combustion  gases, 
and  the  lower  portion  is  presumed  to  be  filled  with  relatively  cooler  air.  Each  of  the  upper 
and  lower  zones  is  assumed  to  have  uniform  temperatures  and  concentrations  of  various 
combustion  gases.  While  this  two-layer  approach  does  not  exactly  mimic  the  complex 
environment  of  a  burning  room,  zone  models  are  desirable  due  to  their  reliability,  relative 
simplicity,  ease  of  use,  and  computational  speed.  The  second  major  category  of  fire 
model  is  the  computational  fluid  dynamic  (CFD)  method  that  relies  on  complex,  three- 
dimensional  computational  cells.  As  Beyler  and  DiNenno  explained,  the  room  or 
compartment  being  modeled  is  computed  as  potentially  thousands  of  discrete  cells  and 
the  temperature,  air  velocity,  and  gas  concentration  of  each  cell  is  calculated.  A  CFD 
model  can  be  used  to  represent  the  complexity  of  a  hostile  fire  environment,  yet  greater 
computational  capacity  (processing  power  and  random  access  memory)  and  more 
detailed  data  input  is  needed  to  create  even  simple  models.  A  widely  recognized 
detenninistic  CFD  model  (Fire  Dynamics  Simulator)  was  used  in  this  study  to  represent 
conditions  in  the  two  prototypical  environments. 

Beyler  and  DiNenno  (2003)  advocated  the  use  of  deterministic  methods  and  said 
that  “perhaps  the  most  important  attribute  of  computer  fire  models  is  their  ability  to 
predict  accurately  and  realistically  the  relevant  fire  behavior  within  their  stated 
limitations”  (p.  3-71).  Despite  their  value,  it  is  important  to  remember  that  fire  models  are 
only  mathematical  representations  of  dynamic  physical  and  chemical  events,  and,  as 
Phillips  added,  “simulation  models  can  not  [sic]  ever  be  validated  over  the  whole  range 
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of  their  behavior”  (p.  5-7).  In  other  words,  models  cannot  be  viewed  as  an  absolute 
representation  or  prediction  of  what  might  happen  during  a  fire;  they  are  intended  to  give 
competent  professional  scientists  and  engineers  an  additional  evaluative  tool  to  perform 
critical  analysis  of  potential  fire  phenomena.  Validation  studies  to  assess  FDS’  accuracy 
at  modeling  pyrolysis  and  flame  spread  concluded  that  without  “tuning”  the  pyrolysis  rate 
coefficients,  it  was  difficult  to  assess  fire  growth  rates  accurately  in  a  combustible  space 
(McGrattan,  McDermott,  Hostikka,  &  Floyd,  2010).  While  this  conclusion  does  not 
invalidate  the  use  of  models,  it  is  an  acknowledgement  that  despite  their  robustness,  they 
are  not  fully  developed.  Confidence  in  the  models’  reliability  is  enhanced  if  the 
mathematical  relationships  are  established  on  sound  scientific  theory  and  full-scale 
experimentation  and  observation  by  knowledgeable  people. 

The  Fire  Dynamics  Simulator  (FDS)  detenninistic  model  developed  and 
maintained  by  the  U.S.  Department  of  Commerce  NIST  was  selected  for  the  fire 
consequence  analysis  of  the  Physical  Security  Criteria  for  Federal  Facilities  standard 
and  the  DBT  .  It  is  a  CFD  model  developed  more  than  25  years  ago  to  solve  complex 
mathematical  equations109  that  represent  the  flow  of  heat  and  smoke  from  fires.  The  FDS 
allows  the  modeler  to  create  a  three-dimensional  virtual  environment  that  represents  the 
space  under  study. 110  The  modeler  is  able  to  specify  spatial  dimensions,  construction 
materials,  doors,  windows,  and  other  openings,111  and  specify  the  inclusion  of  fire 
protection  systems,  such  as  heat  detection,  smoke  detection,  or  automatic  sprinklers.  The 
modeler  also  can  create  and  position  virtual  objects  inside  the  space,  such  as  furniture. 
Data  files  collected  from  numerous  small-  and  full-scale  fire  tests  provide  infonnation  on 
the  thennal  behavior  and  smoke  generating  characteristics  of  building  materials 
(combustible  or  non-combustible)  and  furnishings. 


109  The  calculations  include  Navier-Stokes  equations  that  measure  the  movement  of  fluids  and  gases 
as  they  are  affected  by  gravity,  pressure  and  friction,  direct  numerical  simulation  for  mathematically 
solving  the  Navier-Stokes  equations  and  large  eddy  simulation  to  assess  turbulence  (Kandola,  1995; 
Ferziger,  1996). 

1 10  See  Fire  Dynamics  Simulator  (Version  5)  User’s  Guide  (McGrattan,  McDermott,  Hostikka,  & 
Floyd,  2007)  for  a  detailed  explanation  of  the  product. 

1 1 1  Described  as  “vents”  in  the  model.  The  operation  of  vents  affects  the  air  flow  to  the  fire. 
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The  FDS  enables  the  modeler  to  create  a  variety  of  fire  scenarios  using  pyrolysis 
models  for  solid  or  liquid  fuels,  and  place  the  ignition  source  and  fuels  anywhere  in  the 
virtual  space.  The  model  also  can  be  configured  to  open  or  close  vents  at  various  points 
in  the  scenario  to  simulate  the  opening  and  closing  of  doors  or  windows  that  might  occur 
during  a  live  fire  event,  such  as  when  occupants  open  a  door  to  escape.  In  some 
scenarios,  supply  and  exhaust  fans — such  as  those  occurring  in  heating,  ventilating,  and 
air  conditioning  or  smoke  management  systems — can  be  simulated. 

The  FDS  output  files  provide  a  wealth  of  information  for  assessing  fire  threats 
from  the  defined  input  parameters.  The  model  is  capable  of  providing  data112  on  fire 
HRR,  visibility  obscuration  caused  by  smoke  development  and  migration,  room 
temperatures,  heat  flows  and  thermal  radiation,  and  incapacitating  properties  of  toxic 
gases  including  carbon  monoxide  and  carbon  dioxide  (as  well  as  life  threatening  low 
oxygen  concentrations).  Jahn,  Rein,  and  Torero  (2008)  reported  that  fire  modeling  tools 
provide  good  predictions  of  the  thennal  consequences  of  a  fire,  but  their  ability  to  predict 
fire  development  and  HRR  is  problematic;  therefore,  the  modeler  must  specify  the  HRR 
input  variable.  Results  of  the  data  runs  can  be  produced  in  tabular  or  graphical  outputs,  or 
exported  to  another  NIST  computer  program  called  Smokeview  that  can  provide  a  two-  or 
three-dimensional  representation  of  the  smoke,  heated  gases,  and  surface  temperatures 
(Forney,  2010). 

To  perform  the  modeling  routine,  the  FDS  requires  the  creation  of  a 
computational  domain  that  establishes  the  physical  dimensions  of  the  space,  as  well  as 
any  construction  or  furniture  features  that  will  affect  the  model’s  outputs.  This  virtual 
domain  creates  the  boundaries  for  the  model.  According  to  McGrattan  et  al.  (2007),  it  is 
the  most  challenging  part  of  setting  up  the  simulation  because  for  both  real  and  simulated 
fires,  fire  growth,  and  behavior  is  sensitive  to  the  thermal  properties  of  the  environment, 
and  even  if  all  the  material  properties  are  known,  the  model  itself  may  not  be  capable  of 
rendering  the  fire  with  complete  accuracy.  Tables  47  and  48  in  the  two  model  test 
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The  model  also  can  be  run  with  a  given  HRR  by  inputting  the  information  as  a  bounding  condition. 
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environments  provide  the  physical  input  criteria  for  the  bounded  domains.  Material 
properties  for  building  construction  and  interior  finish,  as  well  as  automatic  fire  sprinkler 
characteristics,  were  developed  from  the  FDS  library  databases. 

The  purpose  for  perfonning  fire  modeling  in  this  study  was  to  attempt  to  assess  if 
one  of  the  secondary  research  questions  could  be  answered:  “How  can  the  arson  threat 
scenario  described  in  the  DBT  be  quantified  for  the  purposes  of  selecting  permanent 
countermeasures?”  Any  fire  behavior  forecasts  developed  from  the  models  must  be 
considered  blind  predictions  because  the  results  are  not  compared  to  any  experimental 
measures  (Gissi,  2010).  Virtual  models  of  two  prototypical  federal  properties  were 
developed,  1)  a  single-story  open  office  arrangement,  and  2)  a  two-story  public  lobby  and 
adjacent  elevator  shaft  enclosures  to  represent  a  courthouse  entrance.  These  examples 
were  selected  based  on  the  fire  incident  data  provide  by  the  GSA  that  showed  80%  of 
fires  in  GSA  properties  occurred  in  office  buildings,  and  10.9%  (the  second  largest 
category)  occurred  in  federal  courthouses.  Design  fire  scenarios  were  created  by  using 
the  small  quantity  accelerant  data  from  the  Bureau  of  Alcohol,  Tobacco,  Firearms  and 
Explosives.  Design  fire  scenarios  were  run  in  both  simulated  environments  to  compare 
fire  consequences  and  detennine  if  recommendations  to  quantify  elements  of  the  DBT 
arson  example  could  be  accomplished. 

1.  Project  Scope 

In  accordance  with  the  SFPE  Engineering  Guide  to  Performance-Based  Fire 
Protection  Analysis  and  Design  of  Buildings,  the  first  step  in  performance-based  analysis 
or  design  is  to  detennine  the  project  scope  to  describe  the  boundaries  of  the  design.  The 
office  and  courthouse  lobby  scenarios  were  selected  based  upon  the  predominant  use  of 
federal  properties  considered  in  this  study. 

a.  Fire  Model  Test  Environment  1:  Single-Story  Open  Office 
Building 

The  first  test  example  represents  a  single-story  office  building  created  to 
support  typical  administrative  functions,  such  as  public  access,  data  collection,  and 
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processing,  bookkeeping,  records  management,  or  contract  administration.  The  physical 
space  consists  of  an  open  plan  work  area  surrounded  by  individual  offices.  The  building 
consists  of  non-combustible  construction,  and  is  protected  by  a  wet  pipe  automatic 
sprinkler  system.  (See  Figure  10  for  a  graphical  representation  of  the  space).  Support 
functions,  such  as  restrooms,  closets,  and  a  breakroom/kitchenette,  are  included.  The  non¬ 
combustible  construction  and  the  fire  sprinkler  system  can  be  considered  the  integral 
elements  of  the  permanent  countermeasures  for  this  scenario’s  evaluation.  A  perimeter 
office  with  an  exterior  window  and  near  the  rear  exit  is  used  as  the  room  of  fire  origin. 


Rear  Exit 


Toilets 

Breakroom 

Office 

■k  (Typical) 

Open  Office 


Main  Entrance 


Figure  10.  Fire  Model  Test  Environment  1:  Single-Story  Open  Office  Building 

To  represent  the  fuel  package  in  the  small  office  and  maintain  simplicity 
in  the  modeling,  the  contents  of  the  small  office  were  rendered  as  a  single  object 
(upholstered  sofa)  having  the  material  properties  of  polymethyl  methacrylate  (PMMA) 
and  a  mass  equal  to  the  accumulation  of  combustibles  found  in  a  typical  office.  PMMA’s 
material  properties113  have  been  studied  extensively  in  laboratory-environment  live  fire 
research,  and  are  a  material  commonly  used  to  represent  the  fuel  package  in  modeling 
scenarios.  The  modeled  object’s  mass  (1305  lbs/592  kg)  was  predicated  on 

113  Conductivity,  specific  heat,  density,  and  emissivity. 
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Madrzykowski’s  (1996)  full-  and  bench-scale  fire  research  conducted  on  office  work 
stations.  Madrzykowski  surveyed  the  GSA  Central  Office  in  Washington,  D.C.  to  create 
the  typical  cubicle  fire  load  for  his  HRR  study.  Having  a  single  object  as  the  ignition 
target  from  the  already  ignited  accelerant  lessened  the  number  of  furnishing  obstructions 
modeled. 


Table  47.  Fire  Model  Test  Environment  1:  Single-Story  Open  Office  Physical  Input 

Criteria 


Condition/Material 

U.S.  Customary 
Units 

SI  Units 

Room 

dimensions 

- 

11.5  x  12  ft 

3.5  x  3.67  m 

Room  Area 

- 

138  ft2 

12.5  m2 

Floor  height 

- 

0  ft 

0  m 

Ceiling  height 

12  feet 

3.6  m 

Model 

dimensions 

- 

19.6x22.9x20.5  ft 

6  x  7  x  6.2484  m 

Ceiling 

configuration 

Smooth,  flat 

- 

- 

Ceiling  finish 

Mineral  fiber  lay-in 
ceiling  tile 

5/8 -inch 

1 6  mm 

Ambient 

temperature 

- 

68  °F 

20  °C 

Ambient 

relative 

humidity 

- 

40% 

40% 

Ambient 

barometric 

pressure 

- 

760  mm  Hg 

101  325  Pa 

Automatic 

sprinklers 

Wet  pipe 

- 

- 

Quick  Response 
Sprinklers:  Response 
Time  Index 
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165 


165 


Condition/Material 

U.S.  Customary 
Units 

SI  Units 

Sprinkler  discharge 
density 

0.10  gpm/ft2 

139  Lpm/m2 

Operating  temperature 

165  °F 

74  °C 

Sprinkler  discharge 
density 

0.10  gpm/ft2 

139  Lpm/  m2 

Sprinkler  K  Factor 

5.6 

80 

Sprinkler  flow 

1 8  gpm 

68.1  lpm 

Floor  covering 

Nylon  caipet 

9/32-inch 

7.8  mm 

Bonded  urethane  pad 

3/8-inch 

9.5  mm 

Subfloor 

Concrete  slab 

6-inch 

150  mm 

Wall  material 

Gypsum  wallboard  on 
steel  framing 

5/8 -inch 

1 6  mm 

Vents 

Exterior  window  (open) 

32  ft2 

3  m2 

Interior  door  (open) 

24  ft2 

2.23  nr 

Smoke 

management 

None 

- 

- 

HVAC 

No  shutdown 

0.12  fit3/fit2 

.003  m3/0.093  m2 

The  FDS  provides  results  that  can  be  captured  in  a  spreadsheet  for  graphic 
representation  in  charts  and  displayed  virtually  using  Smokeview.  Figure  11  is  an 
isometric  rendering  of  design  fire’s  area  of  origin  in  the  small  office  environment. 
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Figure  11.  Isometric  Rendering  of  Fire  Model  Test  Environment  1  Area  of  Origin 

In  the  rendering,  note  that  the  exterior  window  is  labeled  “open”  to  represent  an 
unrestricted  vent  to  the  atmosphere  based  on  the  broken  window  conditions  of  the  design 
fire  scenario.  The  upholstered  sofa  represents  the  entire  fuel  package  in  the  room.  The 
square  beneath  the  upholstered  sofa  is  the  device  that  contains  the  accelerant,  modeled  as 
a  1  MW  burner.  Small  dots  inside  and  outside  the  room  represent  two  virtual 
thermocouple  threes  with  thermocouples  distributed  in  24-inch  (61  cm)  increments 
between  the  floor  and  ceiling.  The  virtual  thennocouple  tree  in  the  office  is  centered  in 
the  room;  the  virtual  thennocouple  tree  outside  the  room  is  12  inches  (30  cm)  from  the 
vertical  plane  of  the  door. 

During  its  run  time,  Smokeview  can  represent  dramatically  the  speed  with  which 
life-sustaining  conditions  are  threatened  during  a  fire.  Figure  12  illustrates  the  fire  and 
smoke  conditions  in  the  small  office  only  79.2  seconds  after  ignition.  The  analysis  of 
smoke  obscuration  on  egress  behavior  conducted  by  Chu  et  al.  (n.d.)  described  how 
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quickly  building  occupants  must  respond  to  achieve  RSET;  Smokeview’s  rendering  of  the 
speed  associated  with  these  deteriorating  conditions  may  convince  skeptics  of  the 
importance  of  rapid  egress. 


Figure  12.  Representative  Smokeview  Smoke  and  Fire  Conditions 

Smokeview  also  has  the  capability  of  rendering  temperature  variations  in  planar 
sections  called  slice  files.  The  color  palette  represents  different  room  temperatures  at  that 
point  in  the  event  ranging  from  blue  (ambient)  to  red  that  signifies  the  highest 
temperatures  achieved  in  the  modeled  environment.  Figure  13  represents  a  temperature 
slice  file  taken  at  approximately  four  minutes  (247.7  seconds)  after  ignition  in  the  office 
that  was  not  protected  by  automatic  sprinklers.  The  turbulent  fire  gases  at  the  room’s 
ceiling  reach  approximately  1,652°F  (900°C),  while  the  temperatures  in  the  adjacent  open 
office  space  range  from  ambient  (68°F  or  20°C)  to  about  200°F  (95°C). 
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Figure  13.  Representative  Smokeview  Slice  File  in  Small  Office  Model 

Finally,  when  displaying  renderings  of  test  environments  in  which  fire  sprinkler 
systems  are  included  in  the  model,  Smokeview  simultaneously  can  display  virtual  water 
droplets  that  represent  sprinkler  water  discharge.  Figure  14  displays  this  feature 
representing  sprinkler  operation  inside  the  office  and  adjacent  open  space  about  114 
minutes  (75.4  seconds)  after  ignition. 
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Frame:  159  _ 

Time:  75.4 

Figure  14.  Representative  Smokeview  Fire  Sprinkler  Virtual  Water  Droplets  in  Small 

Office  Model 


b.  Fire  Model  Test  Environment  2:  Two-Story  Courthouse  Lobby 

The  second  test  example  represents  a  portion  of  an  unspecified-size 
federal  courthouse,  and  consists  of  the  public  entrance  into  a  two-story  open  lobby  area 
on  the  first  floor.  (See  Figure  15  for  a  graphical  representation  of  the  space).  The  lobby  is 
adjacent  and  open  to  a  large,  undefined  space  outside  the  boundary  of  the  model’s 
domain  but  influences  the  model  as  a  vent,  which  in  the  FDS  can  be  a  large,  unobstructed 
opening  that  allows  the  free  exchange  of  entrained  air  and  escape  of  combustion 
products.  This  large  vent  is  identified  by  the  two  shaded  areas  marked  “open  beyond”  in 
the  vertical  plane  of  the  graphic.  The  two-story  lobby  includes  two  banks  of  elevators 
each  having  two  cars  in  two  independent  shafts.  The  lobby  contains  a  security  station, 
assorted  pieces  of  upholstered  furniture,  and  an  information  kiosk.  The  overall  building 
consists  of  fire  resistive  construction,  and  is  protected  by  a  wet  pipe  automatic  sprinkler 
system.  The  fire-resistive  construction  and  the  fire  sprinkler  system  can  be  considered  the 
integral  elements  of  the  permanent  countermeasures  for  this  scenario’s  evaluation.  (Note 
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that  the  security  station  and  information  kiosk  do  not  appear  in  this  rendering;  the 
composition  and  mass  of  the  furniture  is  included  in  the  model  inputs  in  Table  48). 


Figure  15.  Fire  Model  Test  Environment  2:  Two-Story  Courthouse  Lobby 

Like  the  rendering  of  the  small  office  fire  model  test  environment,  the  larger 
space  is  displayed  by  Smokeview  in  an  image  the  enables  the  viewer  a  closer  look  at  the 
pre-event  conditions.  Ligure  16  shows  the  design  fire  model  at  60  seconds  after  ignition, 
and  includes  the  virtual  water  droplets  from  the  fire  sprinkler  system.  This  rendering 
includes  smoke  (soot)  outputs. 
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■  >200  (kW/m3) 

Frame:  125  _ _ 

Time:  60.0 

Figure  16.  Representative  Smokeview  Fire  Sprinkler  Virtual  Water  Droplets  in 

Courthouse  Lobby  Model 

Table  48  provides  the  physical  input  criteria  for  the  bounded  domains  used  in  the 
FDS  model  run. 


Table  48.  Fire  Model  Test  Environment  2:  Two-Story  Courthouse  Lobby  Physical 


Input  Criteria 

Condition/Material  U  S'  <r"s‘°'”a>7 

Units 

SI  Units 

Room  dimensions 

- 

48  x  50  ft 

14.6  x  15.2  m 

Area 

- 

2400  ft2 

222  m2 

Floor  height 

- 

0  ft 

0m 

Ceiling  height 

- 

20  feet 

6.1  m 

Model  dimensions 

- 

19.6x22.9x20.5  ft 

6  x  7  x  6.2484  m 

Ceiling  configuration 

Smooth,  flat 

- 

- 

Ceiling  finish 

TectunT  (direct- 
attached) 

1.5  in 

38.1  mm 

Ambient  temperature 

— 

68  °F 

20  °C 
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Condition/Material 

U.S.  Customary 
Units 

SI  Units 

Relative  humidity 

- 

40% 

40% 

Barometric  pressure 

- 

760  mm  Hg 

101  325  Pa 

Automatic  sprinklers 

Wet  pipe 

- 

- 

Quick  Response 
Sprinklers:  Response 
Time  Index 

165 

165 

Operating  temperature 

165  °F 

74  °C 

Sprinkler  discharge 
density 

0.10  gpm/ft2 

139  Lpm/  m2 

Sprinkler  K  Factor 

5.6 

80 

Sprinkler  flow 

18  gpm 

68.1  lpm 

Floor  covering 

Granite 

- 

- 

Wall  material 

Granite 

- 

- 

Vents 

Exterior  window 
(open) 

32  ft2 

3  m2 

Adjacent  open  space 

Smoke  management 

None 

- 

- 

HVAC 

No  shutdown 

0.12  ft3/ft2 

.003  m3/0.093 
m2 

Elevator  recall 

Phase  One114  on  lobby 
smoke  detection 

aTrade  name  for  a  wood-fiber  composite  panel. 


The  Smokeview  visual  representations,  when  combined  with  expert  analysis  of 
data  outputs  generated  by  the  FDS,  can  be  used  by  Facility  Safety  Committee  members  to 
evaluate  the  effectiveness  of  proposed  permanent  countermeasures  against  arson  threats 
when  the  input  data  is  accurately  represented. 


1 I4  Elevator  cars  are  returned  to  designated  floor  of  egress.  Smoke  detection  devices  are  located  in  the 
elevator  lobbies,  elevator  hoistway  (shaft),  and  elevator  machine  room  (ASME,  2010). 
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2.  Project  Goals,  Design  Objectives  and  Performance  Criteria 


The  second  step  in  the  SFPE  Engineering  Guide  to  Performance-Based  Fire 
Protection  Analysis  and  Design  of  Buildings  is  the  establishment  of  fire  safety  goals  that 
normally  are  prescribed  by  the  project  stakeholders.  The  goals  are  generic  statements 
addressing  desirable  outcomes,  such  as  protecting  life  or  property,  providing  for 
continuity  of  operations,  or  limiting  environmental  impacts  of  the  fire  (National  Fire 
Protection  Association  &  Society  of  Fire  Protection  Engineers,  2000).  For  the  purpose  of 
this  thesis,  the  goals  of  protecting  human  life  (occupants  and  visitors),  and  maintaining 
the  organization’s  on-going  operational  capability  in  accordance  with  federal  continuity 
of  operations  requirements,  were  selected  as  the  most  appropriate  goals  for  the  sample 
scenarios. 

Eventually,  the  goals  are  refined  into  more  specific  design  objectives  and  framed 
in  engineering  tenns  so  they  can  be  measured.  For  office-type  scenarios,  federal 
regulations  describe  these  three  performance  objectives  in  a  building  protected  by 
automatic  fire  sprinklers:  1)  prevent  flashover  in  the  room  of  fire  origin,  2)  limit  fire  size 
to  no  more  than  950  Btu/sec  (1  MW  or  1000  kW),  and  3)  prevent  flames  from  leaving  the 
room  of  origin  (41  CFR  102-80.115,  2005).  In  running  the  fire  modeling  routine,  the 
demarcated  times  from  ignition  to  sprinkler  operation,  the  fire  reaching  950  Btu/sec  (1 
MW  or  1000  kW),  or  flames  leaving  the  room  of  origin,  are  critical.  The  shortest  of  the 
three  times  is  the  allowable  time  available  for  escape  pennitted  by  the  federal  fire  safety 
regulations  when  calculating  the  safety  margin  between  ASET  and  the  RSET  (41  CFR 
102-80.115,  2005).  Although  it  is  recognized  that  a  fire  in  the  perimeter  office  may 
threaten  the  remainder  of  the  office  and  impede  egress  during  nonnal  business  hours, 
separate  egress  modeling  analyses  were  not  conducted  because  representative  population 
data  could  not  be  obtained. 

3.  Design  Fire  Scenarios 

Design  fire  scenarios  are  those  events  that  the  design  team  determines  to  be 

plausible  based  on  an  analysis  of  the  property,  its  use  and  contents,  nature  of  the 

occupants,  and  risk.  To  test  the  hypothesis  whether  performance-based  fire  protection 
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design  methods  are  suitable  to  evaluate  the  effectiveness  of  the  Physical  Security  Criteria 
for  Federal  Facilities  permanent  countenneasures,  the  data  collected  in  the  Delphi  survey 
was  used  to  create  the  modeling  framework  described  in  these  scenarios.  According  to 
the  Delphi  results,  the  most  likely  arson  scenario  in  a  federal  building  or  facility  would  be 
“an  adversary  breaks  a  window  and  ignites  burnable  materials  (make  shift  materials: 
garbage,  rubbish,  waste  paper),  that  can  be  reached  inside.”  To  complicate  the  scenario,  a 
1,000  kW  (1MW)  burner  representing  a  flammable  liquid  IID  was  included  as  a  model 
input.  Figure  17  represents  the  heat  release  rate  signature  of  the  IID.  The  models  were  run 
both  with  and  without  the  operation  of  the  automatic  fire  sprinkler  systems  specified  in 
the  model  inputs  (Tables  47  and  48).  The  automatic  sprinkler  systems  characterize  the 
permanent  countenneasures  being  evaluated. 


Heat  Release  Rate 
(Kilowatts) 


Figure  17.  HRR  Signature  of  Improvised  Incendiary  Device 


4.  Pass-Fail  Criteria 

The  design  fire  scenarios  were  employed  not  to  test  the  perfonnance  of  any 
hypothetical  or  real  designs,  but  to  determine  if  quantifying  the  character  of  a  fire  could 
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aid  in  evaluating  the  range  of  pennanent  countenneasures.  Consequently,  simple  pass-fail 
criteria  were  established  to  assess  the  results  of  the  design  fire  model  runs.  Given  that 
federal  regulations  specify  three  perfonnance  objectives  in  a  building  protected  by 
automatic  fire  sprinklers,  any  of  the  following  results  qualified  as  a  successful  model 
outcome:  1)  prevent  flashover  in  the  room  of  fire  origin,  2)  limit  fire  size  (HRR)  to  no 
more  than  950  Btu/sec  (1  MW  or  1000  kW),  and  3)  prevent  flames  from  leaving  the  room 
of  origin  (41  CFR  102-80.115,  2005).  For  the  purposes  of  evaluation,  flashover  was 
defined  as  a  temperature  of  1,112°F  (600°C)  (Drysdale,  2002,  p.  306)  at  six  inches 
(152  mm)  below  the  ceiling.  Establishing  whether  flames  leave  the  room  of  origin  is 
problematic  in  the  virtual  environment  because  of  the  subjective  interpretation  of  what 
constitutes  “flames.”  Flames  are  a  mixture  of  fire  gases  and  soot  particles  that  emit 
visible  and  infrared  light.  Depending  upon  where  they  are  observed  in  a  room  fire — and 
what  part  of  the  flame  is  being  evaluated — their  temperatures  may  range  from  1,652°F 
(900°C)  in  what  is  called  the  continuous  flame  region  to  about  608°F  (320°C)  at  the 
flame  tip  (McCaffrey,  as  cited  in  Babrauskas,  2006).  The  FDS  does  not  measure  flame 
temperature.  Therefore,  the  ability  through  modeling  to  assess  whether  flames  leave  the 
room  of  origin  is  susceptible  to  subjective  interpretation.  To  establish  if  or  when  flames 
left  the  room  of  origin,  flame  temperature  was  defined  as  visual  products  of  combustion 
transported  by  fire  gases  at  1,500°F  (815°C),  and  was  measured  by  a  single  virtual 
thermocouple  tree  located  in  the  open  portion  of  the  office  building  adjacent  to  the  rear 
path  of  egress,  and  in  the  open  areas  behind  the  elevator  shafts  in  the  two-story 
courthouse  lobby. 

5.  Results 

To  display  some  of  the  data  sets  available  to  Facility  Safety  Committee  members 
who  might  employ  the  FDS  and  Smokeview  as  decision-guiding  tools  in  their  evaluation 
of  proposed  permanent  countermeasures,  the  models  were  run  with  the  test  environments 
represented  both  as  protected  by  automatic  fire  sprinklers  and  without  sprinkler 
protection.  No  first  order  analysis  was  performed;  all  data  results  were  obtained  from  the 
FDS  based  on  the  criteria  provided  in  Tables  47  and  48.  The  second  condition  (no 
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sprinklers)  represents  circumstances  in  which  sprinklers  may  be  absent  from  the  building 
design  and  construction,  or  they  have  been  disabled  through  carelessness  or  malicious 
action,  such  as  might  occur  if  an  adversary  were  trying  to  destroy  a  building  by  fire. 

It  must  be  emphasized  that  the  results  presented  in  this  paper  are  based  on 
mathematical  models  only,  and  may  not  represent  actual  fire  conditions  or  behavior.  Any 
mathematical  analysis  includes  an  amount  of  uncertainty,  as  well  as  expert  analysis  and 
interpretation  of  the  results. 

a.  Fire  Model  Test  Environment  1:  Single-Story  Open  Office 
Building 

Results  from  Fire  Model  Test  Environment  1,  the  single  story  open  office 
building,  are  portrayed  below.  One  of  three  perfonnance  objectives  mandated  under 
federal  fire  safety  regulations  (41  CFR  102-80.1 15,  2005)  is  that  flashover  in  sprinklered 
buildings  must  be  prevented  in  the  room  of  origin.  For  this  thesis  and  the  fire  models, 
flashover  was  defined  as  a  temperature  of  1,112°F  (600°C)  at  6  inches  (152  mm)  below 
the  ceiling.  Figures  18  and  19  display  the  temperature  outputs  in  two-foot  (610  mm) 
increments  inside  the  small  office.  In  the  office  protected  by  quick  response  automatic 
sprinklers  (operating  temperature  165°F  [74°C]),  the  temperature  spikes  to  about  527°F 
(275°C)  within  the  first  30-35  seconds  until  the  sprinkler  operates  and  begin  to 
dramatically  cool  the  atmosphere  between  three  and  1 1  feet  (914  to  3,352  mm)  above  the 
floor.  After  the  first  minute,  the  temperature  in  that  zone  remains  between  122  and  302°F 
(50-150°C). 
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Figure  18.  Small  Office  Temperature  Curves  with  Sprinklers 


Figure  19.  Small  Office  Temperature  Curves  without  Sprinklers 
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According  to  the  data  presented  in  Figure  18,  flashover  is  never  achieved 
in  the  office  space  protected  by  automatic  sprinklers;  whereas  without  sprinkler 
protection,  flashover  at  six  inches  (152  mm)  below  the  ceiling  is  reached  between  50  and 
100  seconds  (approximately  80  seconds)  after  ignition  (Figure  19).  The  temperature  in 
the  non-sprinklered  space  continues  to  rise  to  about  1,472°F  (800°C)  within  six  inches  of 
the  ceiling,  and  anywhere  from  572  to  1,472°F  (300  to  800°C)  throughout  the  entire 
habitable  space. 

These  conditions  are  visually  rendered  in  Figures  20  and  21,  which  are 
slice  files  captured  330.7  and  326.4  seconds  after  ignition  with  corresponding 
temperature  ranges,  respectively. 115  In  both  cases,  even  if  a  reviewer  were  unable  to 
interpret  the  scientific  data,  the  emotional  responses  to  the  represented  color  spectrum 
suggest  areas  within  the  space  ranging  from  tolerable  to  dangerous  to  human  occupancy 
(Valdez  &  Mehrabian,  1994).  The  blue  end  of  the  spectrum  represents  survivable 
temperatures  from  68  to  131°F  (20  to  55°C)  where  the  orange-red  end  of  the  spectrum 
represents  temperatures  from  572  to  almost  1,700°F  (335  to  920°C)  that  could  not 
support  human  life  in  a  normal  office  environment. 


Note  the  open  vent  at  the  left  side  midpoint  of  the  illustrations  in  both  Figures  19  and  20.  This  vent 
represents  the  adversary’s  access  point — by  breaking  the  window — that  provides  both  additional  air  for 
combustion  and  a  path  for  the  fire. 
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Frame:  689 
Time:  330.7  I 

Figure  20.  Temperature  Slice  File  in  Sprinklered  Small  Office 


Time:  326.4 

Figure  2 1 .  Temperature  Slice  File  in  Non-sprinklered  Small  Office 


The  second  criterion  needed  to  satisfy  federal  building  safety  regulations 
is  that  the  fire  size  is  limited  to  no  more  than  950  Btu/sec  (1  MW  or  1,000  kW).  Figures 
22  and  23  represent  the  fire  size  in  terms  of  HRR  that  describe  the  amount  of  heat 
released  over  a  unit  of  time  by  one  or  more  burning  objects  (See  Table  22). 


- Total  HRR 

- 1 1 D  HRR 


Figure  22.  Sprinklered  Small  Office  FIRR 
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Figure  23.  Non-sprinklered  Small  Office  FIRR 


In  both  scenarios,  the  virtual  fires  exhibit  rapid  growth,  and  exceed  the 
950  Btu/sec  (1,000  kW  or  1  MW)  limit  in  less  than  30  seconds.  This  behavior  is 
consistent  with  the  ultrafast  T  HRR  curve  shown  in  Figure  8  and  can  be  employed  as  an 
important  constituent  in  setting  the  design  fire  criteria  used  to  analyze  performance-based 
design  solutions.  As  Figure  22  shows,  except  for  several  anomalous  spikes  between  100 
and  120  seconds,  the  peak  FIRR  occurs  at  about  2,370  Btu/sec  (2,500  kW  or  2.5  MW)  at 
120  seconds  and  begins  a  steady  downward  trend  as  the  operating  sprinklers  control  the 
fire  toward  extinction.  This  HRR  represents  the  energy  released  by  the  IID  and  the 
furnishings  and  other  combustibles  in  the  space,  as  well  as  the  re-radiative  influence  of 
the  enclosure.  The  fire  drops  below  the  950  Btu/sec  (1  MW  or  1,000  kW)  threshold  at 
about  420  seconds  (7  minutes)  after  ignition.  The  HRR  curve  corresponds  to  the  IID 
HRR  curve  such  that  an  approximately  950  Btu/sec  (1,000  kW  or  1  MW)  difference 
occurs  between  the  two  at  any  point  within  the  federal  criteria. 
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However,  in  the  non-sprinklered  space,  the  peak  HRR  is  about  5,686 
Btu/sec  (6,000  kW  or  6.0  MW)  at  about  120  seconds,  and  trends  downward  only  slightly 
during  the  remainder  of  the  model  run  (an  additional  360  seconds  or  six  minutes),  which 
suggests  the  small  office  remains  a  highly  energized  environment  throughout  the  duration 
of  the  incident  due  to  the  amount  of  fuel  and  re -radiative  effects  of  the  enclosure.  The 
absence  of  automatic  sprinkler  protection  renders  this  space  untenable,  and  a  failure  to 
meet  the  federal  lire  safety  criteria. 

Finally,  the  federally  mandated  third  performance  objective  for  lire 
protection  in  office  occupancies  is  to  coniine  the  flames  to  the  room  of  origin.  For  this 
scenario,  a  flame  temperature  was  defined  as  visual  products  of  combustion  transported 
by  fire  gases  at  1,500°F  (815°C),  and  was  estimated  by  a  single  virtual  thermocouple  tree 
located  in  the  open  office  space  outside  the  small  office  defined  as  the  room  of  lire 
origin. 

Figures  24  and  25  represent  the  temperature  ratings  at  24-inch  (610  mm) 
intervals  12  inches  (30  cm)  outside  the  small  office.  In  neither  case  (sprinklered  or  non- 
sprinklered)  did  the  flame  temperature  outside  the  office  exceed  the  1,500°F  (815°C) 
performance  threshold. 
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Figure  24.  Flame  Temperature  Outside  Small  Office  Room  of  Origin  (Sprinklered) 
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Figure  25.  Flame  Temperature  Outside  Small  Office  Room  of  Origin  (Non-sprinklered) 
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Data  points  in  Figure  25  demonstrate  what  appears  to  be  an  anomaly, 
temperatures  at  5  and  7  feet  above  the  floor  (1,524  and  2,134  mm)  are  higher  than  those 
at  nine  or  1 1  feet  (2,743  or  3,533  mm).  Normally,  higher  fire  temperatures  are  recorded  at 
the  highest  point  of  an  enclosure  in  which  the  thennal  plume  reaches  the  ceiling.  The 
apparent  discrepancy  can  be  explained  by  the  design  of  the  wall  between  the  small  office 
and  the  open  area,  and  position  of  the  virtual  thermocouples.  Notice  in  Figures  13  and  21, 
the  wall  where  the  office  door  occurs  is  designed  with  a  lintel  approximately  5  feet  (1,524 
mm)  down  from  the  ceiling  that  provides  a  solid  barrier  between  the  small  office  and 
open  area.  This  lintel  limits  the  flaming  ceiling  jet  and  turbulent  outflow  in  the  small 
office  from  escaping  into  the  open  area.  The  doorway  (a  vent)  between  the  two  spaces  is 
located  beneath  the  lintel,  and  allows  flames  to  escape  the  room  of  origin  at  the  5  to  7 
foot  range  (1,524  and  2,134  mm)  where  they  are  detected  by  the  virtual  thermocouples. 

b.  Fire  Model  Test  Environment  2:  Two-Story  Courthouse  Lobby 

The  second  test  environment  represents  a  portion  of  an  unspecified-size 
federal  courthouse,  and  consists  of  the  public  entrance  into  a  two-story  open  lobby  area 
on  the  first  floor.  (See  Figure  15  for  a  graphical  representation  of  the  space).  The  model 
was  subjected  to  the  same  design  fire  test  stress  as  the  small  office  building.  Figures  26 
and  27  represent  the  temperatures  at  different  elevations  for  a  lobby  protected  by 
automatic  fire  sprinklers  and  one  that  is  not,  respectively.  In  Figure  26,  the  temperature 
near  the  second-floor  ceiling  at  19  feet  (5,791  mm)  above  the  floor  ranges  between  248  to 
320°F  (120  to  160°C)  whereas  the  temperature  range  at  the  walking  surface  range  from 
68  to  140°F  (20  to  60°C).  In  the  non-sprinklered  lobby  (Figure  27),  the  ceiling 
temperature  nearly  reaches  flashover  (spiking  at  932°F  [500°C]  at  about  120  seconds), 
while  after  60  seconds,  the  walking  surface  temperatures  remain  dangerously  high  212  to 
257°F  (100  to  125°C). 

In  neither  case  did  the  design  fire  reach  the  critical  flashover  temperature 
of  1,112°F  (600°C)  at  six  inches  (152  mm)  below  the  ceiling.  Therefore,  this  design  can 
be  interpreted  as  meeting  one  of  the  three  fire  safety  criteria  codified  in  federal  law. 
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Figure  26.  Courthouse  Lobby  Temperature  Curves  with  Sprinklers 
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Figure  27.  Courthouse  Lobby  Temperature  Curves  without  Sprinklers 
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Figures  28  and  29  are  slice  files  of  the  virtual  courthouse  lobby  at  326.4 
and  331.2  seconds  after  ignition,  respectively.  While  both  images  evoke  an  emotional 
response  that  suggests  the  environment  might  easily  support  human  life,  it  is  important  to 
note  the  difference  in  temperature  scale  at  the  right  hand  side  of  the  illustration.  The  color 
spectrum  in  Figure  28  (the  sprinklered  lobby)  ranges  from  59  to  599°F  (15  to  315°C), 
while  the  temperatures  in  Figure  29  range  from  68  to  1,148°F  (20  to  620°C).  A  FSC 
reviewing  modeling  data  should  insist  that  data  be  represented  consistently  in  a  fashion 
that  permits  balanced  analysis. 


Frame:  680 
Time:  326.4 


I  >200  (kW/m3) 


Figure  28.  Temperature  Slice  File  in  Sprinklered  Courthouse  Lobby 
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Figure  29.  Temperature  Slice  File  in  Non-sprinklered  Courthouse  Lobby 

The  second  performance  objective  in  federal  fire  safety  criteria  (the  FIRR 
not  exceeding  950  Btu/sec  [1  MW  or  1,000  kW])  is  surpassed  in  less  than  30  seconds  in 
both  the  sprinklered  and  non-sprinklered  scenarios  (Figures  30  and  31,  respectively).  This 
behavior  is  consistent  with  the  ultrafast  t  FIRR  curve  shown  in  Figure  8  and  is  an 
important  constituent  in  setting  the  criteria  to  analyze  perfonnance-based  design 
solutions.  For  the  most  part,  the  sprinkler  system  cools  the  environment  and  keeps  the 
total  FIRR  within  950  Btu/sec  (1,000  kW  or  1  MW)  of  the  IID  HRR  curve.  However, 
between  100  and  200  seconds,  HRR  values  exceed  this  difference.  Those  data  simply 
may  be  the  result  of  sensitivity  issues  in  the  modeling.  According  to  McGrattan  (2007), 
the  FDS  may  produce  results  having  a  difference  of  as  much  as  15%  above  or  below 
actual  HRR.  For  the  purpose  of  this  thesis,  with  the  limited  number  of  model  runs  and  the 
fact  a  period  exists  in  which  the  total  HRR  exceeds  the  performance  threshold,  it  must  be 
concluded  that  is  uncertain  whether  the  sprinkler  system  is  an  effective  countermeasure. 
Consequently,  this  specific  scenario  needs  additional  study  and  analysis. 

Figure  31,  the  non-sprinklered  lobby  space,  shows  the  total  HRR  that 
exceeds  the  permitted  threshold  by  1,900  Btu/sec  (2  MW  or  2,000  kW)  or  more,  which 
thus,  does  not  comply  with  federal  fire  safety  criteria. 
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Figure  30.  Sprinklered  Courthouse  Lobby  HRR 


Heat  Release  Rate 


- Total  HRR 

—  IIP  HRR 


Figure  3 1 .  Non-sprinklered  Courthouse  Lobby  HRR 
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The  final  scenario  modeled  in  this  environment  was  to  determine  whether 
the  flames  left  the  room  of  origin.  To  assess  this  result,  flame  temperature  was  defined  as 
visual  products  of  combustion  transported  by  fire  gases  at  1,500°F  (815°C)  measured  at 
the  virtual  thermocouples  in  the  egress  path.  Figures  32  and  33  represent  this  data.  While 
the  peak  ceiling  temperature  in  the  sprinklered  area  was  measured  at  356°F  (180°C)  in 
the  sprinklered  building  and  662°F  (350°C)  in  the  non-sprinklered  building,  the  model 
runs  in  both  configurations  produced  temperatures  substantially  lower  than  the  designated 
limit. 
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Figure  32.  Courthouse  Lobby  Egress  Path  Temperatures  (Sprinklered) 
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Figure  33.  Courthouse  Lobby  Egress  Path  Temperatures  (Non-sprinklered) 


The  purpose  of  the  modeling  analysis  was  not  to  validate  any  particular 
design,  but  to  illustrate  how  modem  fire  modeling  tools,  such  as  the  FDS  and  Smokeview, 
can  be  employed  to  perfonn  pre-design  and  construction  analysis  to  evaluate  not  only 
threats,  but  analyze  a  variety  of  proposed  permanent  countermeasures.  In  the  examples 
shown,  the  quantified  threat  was  defined  by  a  sample  of  expert  fire  investigators  who 
described  a  plausible  fire  threat  scenario.  This  threat  scenario  was  applied  in  the  model  to 
four  different  configurations  using  automatic  fire  sprinkler  protection  as  the  designated 
permanent  countermeasure.  Table  49  summarizes  the  results  of  the  model  outputs 
comparing  the  permanent  countermeasures  to  the  three  legally  mandated  fire  safety 
perfonnance  objectives. 
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Table  49.  Fire  Modeling  Test  Result  Summary 


Prevent 

Flashover 

Limit  Fire 
Size 

Confine  Flames 
to  Room  of 
Origin 

Small  Office 

Sprinklered 

Pass 

Pass 

Pass 

Small  Office 

Non-sprinklered 

Fail 

Fail 

Pass 

Courthouse  Lobby 

Sprinklered 

Pass 

Uncertain 

Pass 

Courthouse  Lobby 

Non-sprinklered 

Pass 

Fail 

Pass 

Modeling  applications  offer  the  ability  to  quantify  the  character  of  the  data 
inputs.  For  the  FDS  and  Smokeview,  the  building  occupancy  type,  its  construction 
materials  and  size,  and  the  fire  protection  features  can  be  defined  in  a  virtual  world  and 
one  or  more  threats  applied  to  it.  Altering  any  one  of  these  variables  can  provide  outputs 
against  which  permanent  countermeasures  can  be  assessed. 

E.  SUMMARY 

The  mixed  methods  research  approach  provided  a  multi-focused  picture  of  several 
factors  that  must  be  considered  to  conduct  a  thorough  policy  analysis.  Results  from  the 
national  fire  incident  data  analysis,  the  thematic  content  analysis,  the  Delphi  survey  of 
fire  service  professionals,  and  the  fire  modeling  scenarios,  provided  a  variety  of  data  sets 
that  enabled  agglomeration  of  their  results  to  better  interpret  the  elements  that  comprise 
the  Physical  Security  Criteria  for  Federal  Facilities  standard  and  the  DBT  to  conduct  a 
more  complete  policy  analysis.  The  modeled  scenarios,  given  a  clear  set  of  inputs, 
provide  persuasive  data  outputs  and  illustrations  that  can  explain  how  proposed 
protective  countermeasures  can  be  evaluated. 
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VIII.  CONCLUSIONS  AND  RECOMMENDATIONS 


As  the  nation’s  largest  property  manager,  the  federal  government  owns  and 
maintains  buildings  and  facilities  in  which  its  employees  and  visitors  are  subject  to  a 
variety  of  threats  ranging  from  terroristic  attacks  to  natural  disasters.  To  enhance  security 
against  a  variety  of  threat  scenarios,  the  DHS  ISC  has  created  a  Physical  Security 
Criteria  for  Federal  Facilities  standard  to  reduce  risk  and  consequences  of  unwanted 
threats.  This  standard  uses  a  risk  management  assessment  approach  to  determine  levels  of 
physical  and  operational  protection  expected  to  minimize  the  consequences  of  attacks. 
This  thesis  argues  that  the  results  collected  through  this  risk  management  assessment 
devolve  into  past-practice  prescriptive  countermeasure  solutions  that  may  not  be  best 
suited  to  protect  facilities  and  occupants  from  varied  threats;  and  the  use  of  performance- 
based  design  methods  could  help  FSC  address  identified  threats  with  custom  solutions. 

A.  RESEARCH  CONCLUSIONS 

1.  Primary  Research  Question  Answered 

The  primary  research  project  focused  on  one  threat  identified  in  the  DBT 
document  that  accompanies  the  Physical  Security  Criteria  for  Federal  Facilities,  the 
arson  scenario  in  which  “an  adversary  places  an  improvised  incendiary  device  (IID) 
containing  an  accelerant  and  utilizing  a  delay  mechanism  adjacent  to  a  facility,  but 
outside  the  view  of  security  countermeasures”  to  detennine  how  perfonnance-based 
design  methods  could  evaluate  the  effectiveness  of  the  Physical  Security  Criteria  for 
Federal  Facilities  permanent  countenneasure  options  to  arson  threats. 

The  fire  data  research  element  showed  that  overall,  federally  owned,  and  occupied 
buildings  and  facilities  perform  well  when  threatened  by  accidental  or  intentional  fires. 
Over  a  three-year  study  period,  86.4%  of  fires  in  federal  office  buildings  were  confined  to 
the  room  or  object  in  which  the  fire  started,  compared  to  18.1%  of  the  non- federal  office 
buildings.  Similarly,  in  federal  courthouses,  fires  were  contained  to  the  room  or  object  of 
origin  33.1%  of  the  time,  compared  to  8.1%  in  non-federal  courthouses.  Additional 
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research  is  warranted  to  identify  factors  influencing  the  outcomes116  between  federal  and 
non-federal  properties.  However,  given  the  comparative  success  of  containing  fires  to  the 
object  or  room  of  origin  in  conjunction  with  the  preponderance  of  accidental  ignition 
sources  in  federal  buildings,117  it  appears  the  “applicable  construction  [and  life  safety] 
standards”  cited  in  the  Physical  Security  Criteria  for  Federal  Facilities  and  the  DBT  are 
adequate  to  satisfy  the  primary  goal  of  life  safety  and  the  secondary  goals  of  property 
protection  and  environmental  controls. 

The  thematic  analysis  of  the  use  of  performance-based  design  as  a 
countermeasure  to  arson  threats  was  less  definitive.  Evidently,  performance-based  design 
has  not  been  given  significant  consideration  in  the  international  literature  as  a  means  to 
design  buildings  and  fire  protection  features  to  protect  from  an  arson  attack.  In  a  review 
of  150  articles  on  the  subject  of  perfonnance-based  design  for  fire  safety,  slightly  more 
than  two-thirds  of  the  authors  did  not  mention  its  suitability  against  incendiary  fires. 
More  significant,  however,  was  the  emphasis  on  scenario  design.  Nearly  71%  of  the 
authors  who  evaluated  its  effectiveness  to  counter  incendiary  threats  stressed  the 
importance  of  well-defined  design  fire  scenarios.  This  thesis  has  argued  the  Physical 
Security  Criteria  for  Federal  Facilities  arson  scenario118  is  too  vaguely  defined  for  the 
development  of  effective  countenneasures.  The  thematic  analysis  results  support  this 
hypothesis. 

The  Delphi  survey  approach  produced  an  arson  threat  scenario  quite  different 
from  that  described  in  the  Physical  Security  Criteria  for  Federal  Facilities.  Rather  than 
using  an  accelerant-based  IID  with  a  timing  device,  the  experts  developed  a  scenario  in 
which  an  adversary  simply  breaks  into  the  building  or  facility  and  employs  makeshift 
aids  (e.g.,  waste  paper,  garbage,  other  combustible  materials  at  hand)  to  fuel  a  fire.  To 
enhance  the  value  of  this  scenario  as  an  element  in  a  perfonnance-based  design,  it  must 

116  Among  others,  factors  could  include  the  existence  of  automatic  fire  detection  and  suppression 
systems,  fire  resistive  construction  with  automatic  opening  protectives  (e.g.,  fire  doors  and  dampers), 
aggressive  enforcement  of  safety  rules  and  regulations,  or  an  employee  culture  commitment  to  maintaining 
a  safe  working  environment. 

117  Only  5.4%  of  fire  incidents  were  malicious. 

1 18  In  which  "an  adversary  places  an  improvised  incendiary  device  (IID)  containing  an  accelerant  and 
utilizing  a  delay  mechanism  adjacent  to  a  facility,  but  outside  the  view  of  security  countermeasures.” 
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be  improved  by  additional  qualification  and  quantification  to  describe  better  the  location 
of  where  the  fire  was  set  in  relation  to  walls,  ceilings,  doors  or  windows,  as  well  as  have 
a  more  specific  description  of  the  type  and  amount  of  combustible  materials  ignited. 

Finally,  the  results  of  the  fire  effects  modeling  exercises  show  that  by  quantifying 
the  criteria  for  both  the  design  fire  scenario  and  countenneasure  features  (e.g., 
construction  type,  fire  protection  features,  fuel  controls),  a  blind  prediction  of  outcomes 
that  meet  federal  fire  safety  requirements  can  be  obtained. 

2.  Secondary  Research  Questions  Answered 

In  addition  to  the  primary  question  of  the  applicability  of  performance-based 
design  methods  to  federal  building  and  facility  protection,  this  thesis  included  three 
secondary  research  questions. 

•  How  can  the  arson  threat  scenario  described  in  the  DBT  be  quantified  for 
the  purposes  of  selecting  permanent  countermeasures? 

As  shown  in  the  results  of  the  thematic  literature  review,  the  quantification  of  the 
design  fire  scenario  is  critical  to  the  evaluation  of  the  modeled  results,  including 
countermeasures.  The  DBT  arson  scenario  in  which  “an  adversary  places  an  improvised 
incendiary  device  (IID)  containing  an  accelerant  and  utilizing  a  delay  mechanism 
adjacent  to  a  facility,  but  outside  the  view  of  security  countermeasures”  would  be 
quantified  by  defining  input  parameters,  such  as  the  type  and  amount  of  accelerant, 
description  of  the  facility  construction,  and  spatial  relationship  of  the  IID  to  the  facility. 
For  example,  the  scenario  could  be  rewritten  “an  adversary  places  an  improvised 
incendiary  device  (IID)  containing  five  gallons  (19  L)  of  gasoline  and  utilizing  a  delay 
mechanism  on  an  asphalt  surface  six  inches  (152  mm)  from  a  24-foot  (7315  mm)  exterior 
wall  comprising  four-inch  (102  mm)  brick  installed  over  10  mil  moisture  barrier  applied 
to  0.625-inch  (15.9  mm)  oriented  strand  board  supported  by  two  by  four-inch  (51  by  102 
mm)  and  clad  on  the  interior  with  0.625-inch  (15.9  mm)  Type-X  gypsum  wallboard,  but 
outside  the  view  of  security  countenneasures.  The  IID  is  placed  36  inches  (914  mm) 
beneath  a  sealed  vinyl  frame  window  measuring  42  inches  (1,067)  wide  by  48  inches 
(1,219  mm)  tall.”  While  the  latter  scenario  details  require  extra  effort  to  account  for  each 
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potential  condition,  in  terms  of  fire  safety  perfonnance,  it  provides  the  infonnation 
needed  to  perfonn  a  successful  blind  prediction  of  the  consequences  the  IID  would  have 
on  the  building  or  facility. 

•  Are  the  design  methods  published  in  the  SFPE’s  SFPE  Engineering  Guide 
to  Performance  Based  Fire  Protection  or  the  ICC’s  Performance  Code  for 
Buildings  and  Facilities  suitable  tools  to  evaluate  pennanent 
countenneasure  options  to  quantified  arson  threats? 

Although  the  thematic  literature  review  showed  little  recognition  by  name  of 
these  two  documents,119  substantial  concordance  existed  with  the  design  methods 
employed  by  the  SFPE  and  ICC.  Figure  5  represents  the  SFPE  perfonnance-based  design 
process.  The  fire  modeling  exercise  used  in  this  thesis  integrated  this  process  to  the  extent 
necessary  to  test  the  hypothesis  of  design  fire  quantification. 

An  added  advantage  of  the  performance-based  design  approach  is  its  use  of 
validated  models  to  simulate  a  variety  of  events,  and  provide  outputs  in  graphical  and 
visual  renderings  that  can  be  easily  explained  by  qualified  people.  Input  variables  on  the 
models  can  be  altered  and  run  at  relatively  little  cost  until  the  desired  output  is  achieved. 

While  the  nomenclature  of  the  SFPE  performance-based  design  process  differs 
from  the  Physical  Security  Criteria  for  Federal  Facilities  risk  assessment  model,  it 
employs  similar  principles:  defining  scope,  identifying  goals  and  objectives,  performance 
criteria,  and  developing  scenarios  and  trial  designs  (countenneasures).  The  significant 
difference  between  the  two  is  the  Physical  Security  Criteria  for  Federal  Facilities 
standard  relies  on  prescriptive  countenneasures  for  an  unlimited  variety  of  threat 
scenarios,  whereas  the  SFPE  performance-based  design  process  allows  stakeholders  to 
define  the  threats  and  customize  temporary  or  permanent  countermeasures. 

•  Should  the  ISC  reports  Physical  Security  Criteria  for  Federal  Facilities 
and  the  DBT  be  limited  to  criminal  or  “manmade”  threats  as  stated  in  the 
documents? 

Over  time,  the  GSA,  which  is  responsible  for  the  construction  and  maintenance  of 
non-military  and  non-postal  federal  property,  is  moving  from  a  solely  prescriptive  design 

119  Only  0.7%  of  respondents  mentioned  the  SFPE  engineering  guide  by  title  and  one  doctoral 
dissertation  referenced  the  ICC  code. 
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and  construction  approach  to  encouraging  the  precepts  of  performance-based  design.  The 
GSA  Facilities  Standards  for  the  Public  Buildings  sendee  (PI  00)  embraces  performance- 
based  design  alternatives. 

Given  the  number,  nature,  and  consequences  of  fires  in  federal  facilities  since 
2007  (Tables  31  through  35),  the  GSA  construction  standards  perfonn  well  compared  to 
non-federal  properties.  In  86.4%  of  the  fires  in  federal  office  buildings,  and  33% 120  of  the 
fires  in  federal  courthouses,  the  fire  was  contained  to  the  room  or  object  of  origin;  thus 
meeting  one  critical  condition  of  the  GSA’s  federal  fire  safety  regulations.  If  the  criminal 
or  “manmade”  design  threat  scenarios  in  the  DBT  were  quantified  using  performance- 
based  design  methods,  keeping  the  Physical  Security  Criteria  for  Federal  Facilities 
emphasis  on  criminal  or  “manmade”  threats  is  appropriate. 

B.  STUDY  LIMITATIONS 

The  following  limitations  on  this  study  are  acknowledged. 

First,  the  Delphi  survey  to  assess  the  likelihood  of  the  arson  scenario  published  in 
the  DBT  was  conducted  among  a  small  population  of  fire  investigation  experts,  N=18. 
The  distribution  of  the  results  shows  that  respondents  were  equally  divided  between  the 
scenario  being  unlikely  or  likely,  with  a  small  percentage  (16.7%,  n=3)  reporting  the 
scenario  to  be  highly  likely.  The  survey  enabled  the  experts  to  develop  an  alternate  arson 
scenario  based  on  their  experience  and  opinion. 

To  enhance  the  validity  of  the  Delphi  survey  and  its  results,  a  larger  population 
should  be  studied.  The  population  should  be  geographically  and  experientially  diverse, 
and  likely  have  a  high  degree  of  skill  in  collecting  and  analyzing  fire  incident  data. 

Second,  the  data  assumptions  created  for  the  two  modeling  scenarios  were 
selected  arbitrarily  and  based  on  a  subjective  basis  regarding  the  construction,  content, 
use,  and  occupancy  of  a  so-called  typical  federal  office  space  and  courthouse  lobby.  The 
criteria  were  used  solely  to  demonstrate  the  use  of  the  fire  effects  modeling  as  an  analysis 

' 211  In  federal  courthouse  fires,  N=6;  therefore,  so  the  data  set  is  extremely  small  for  conducting 
meaningful  analysis. 
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tool,  and  no  claim  is  made  that  the  scenarios  represent  real  conditions  that  may  be  found 
in  these  occupancies.  To  conduct  fire  effects  modeling  with  a  lesser  degree  of 
uncertainty,  the  data  inputs  should  be  collected  from  full-scale  examples.  Results  of  the 
fire  effects  models  that  contend  to  represent  real  world  scenarios  should  be  peer  reviewed 
by  qualified  scientists  and  engineers  with  experience  in  fire  behavior  and  modeling.  As 
Rein  et  al.  (2011)  expressed  in  their  Dahnarnock,  Scotland  studies,  even  the  possession  of 
good  input  data  may  not  result  in  the  fire  effects  model  representing  it  accurately. 

Finally,  while  altruistically  the  ultimate  social  goal  is  life  safety,  employee  and 
visitor  safety,  or  survival  were  not  addressed  in  this  study.  Data  on  employee  and  visitor 
population  and  characteristics  was  not  available;  therefore,  the  study  was  limited  to  arson 
attack  modes  that  could  occur  whether  the  building  or  facility  was  occupied  or  not. 
Additionally,  results  from  the  Delphi  survey  suggested  the  most  likely  arson  scenario 
occurred  when  the  building  was  not  occupied  or  was  occupied  after  hours  by  only  a  very 
small  population,  such  as  maintenance  or  housekeeping  personnel. 

C.  IMPLEMENTATION  ISSUES 

The  ISC  Physical  Security  Criteria  for  Federal  Facilities  interim  standard  was 
issued  April  12,  2010  for  a  24-month  validation  period.  That  deadline  has  passed.  To 
implement  the  policy  recommendation  made  below,  the  ISC  will  have  to  review  the 
proposed  policy  and  consider  reopening  the  validation  period  while  it  tests  and  validates 
the  proposed  methods. 

D.  ISSUES  FOR  FUTURE  RESEARCH 

Although  rich  and  diverse  sources  of  literature  on  building  construction,  fire 
protection,  perfonnance-based  designs,  federal  facilities,  and  terrorist  threats  are  avaible, 
significant  gaps  worthy  of  additional  research  remain.  This  thesis  suggests  the  following 
topics  for  future  research. 
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1. 


Fire  Effects  Modeling  for  the  Sample  Scenarios 


The  two  building  fire  scenarios  employed  in  this  thesis  were  selected  solely  to 
demonstrate  the  use  of  fire  effects  modeling  as  one  tool  that  can  be  employed  to  evaluate 
pennanent  countermeasure  proposals  against  asymmetric  threats. 

Sample  physical  world  federal  office  and  courthouse  facilities  should  be  surveyed 
to  collect  data  on  construction,  fuel  load,  fuel  array,  use,  and  occupancy  for  the  purpose 
of  conducting  fire  effects  modeling  analysis  of  pennanent  countenneasures  already  in 
place  or  proposed  as  part  of  the  ISC  facility  security  level  assessments. 

2.  Data  Collection,  Management  and  Analysis 

Considering  the  number,  size,  and  value  of  federal  government  real  property 
assets,  comprehensive  studies  of  fire  and/or  arson  incidents  and  their  impact  on  both 
physical  property  and  continuity  of  operations  are  in  order.  It  is  remarkable  that  the  GSA, 
the  government’s  largest  non-military  and  non-postal  property  manager,  has  no 
meaningful  instrument  to  collect  and  analyze  fire  and/or  arson  incidents,  especially  since 
it  has  been  more  than  10  years  since  the  GAO  identified  this  shortcoming. 

Additional  research  should  be  conducted  to  develop  a  data  collection, 
management,  and  analysis  instrument  for  federal  buildings  and  facilities,  or  the  GSA 
should  work  with  the  USFA  NFDC  to  develop  a  “special  reports”  category  unique  to 
federal  assets  that  could  be  appended  to  the  existing  NFIRS. 

3.  Design  Fire  Scenarios 

An  unending  need  exists  for  additional  research  on  worst-case  design  fires,  such 
as  the  use  of  accelerants  and  IIDs  to  quantify  both  the  inputs  and  consequences.  While 
the  literature  on  design  fires  continues  to  grow,  full-scale  fire  testing  is  time-consuming 
and  expensive.  Fire  tests  often  are  driven  by  propriety  needs  to  develop  specific  fire 
protection  countermeasures  in  government,  business,  and  industry.  A  large-scale  project, 
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perhaps  funded  by  the  federal  government,  would  be  useful  to  create  a  repository  of 
design  fire  data  that  could  be  used  for  perfonnance-based  design  applications  in  federal 
and  non- federal  buildings  and  facilities. 

Furthennore,  the  specific  scenario  in  this  thesis  of  the  two-story  sprinklered 
courthouse  atrium  needs  additional  study  and  analysis  to  detennine  whether  automatic 
sprinkler  protection  can  perform  as  a  suitable  countermeasure  to  an  accelerated  fire  by 
keeping  the  HRR  under  950  Btu/sec  (1,000  kW  or  1  MW). 

4.  Application  of  Fire  Models  to  Worst  Case  Catastrophic  Design  Fires 

Concurrent  with  full-scale  fire  testing,  research  should  be  conducted  to  measure 
the  validity  of  existing  fire  effects  models — or  to  develop  new  ones — that  can  provide 
consistent  and  reliable  blind  predictions  of  catastrophic  design  fires.  As  asymmetric 
homeland  security  threats  evolve,  criminals,  or  terrorists  are  likely  to  adapt  their 
destructive  methods  to  exploit  vulnerabilities  in  the  built  environment  (Leiter  et  al., 
2012).  The  federal  government  has  an  interest  in  maintaining  current  data  analysis  tools 
to  protect  its  human  and  inanimate  assets. 

5.  Real  Property  Tenancy  and  Ownership 

The  fire  incident  data  accumulated  for  this  study  shows  that  a  significant 
difference  exists  in  fire  outcomes  between  federally  owned  and  occupied  real  property 
and  all  others.  Does  tenancy  or  ownership  make  a  difference  in  fire  prevention  and 
protection?  Does  the  fact  federal  buildings  are  under  single  managerial  control  affect  fire 
incidents  and  outcomes? 

Research  to  explore  the  nature  of  fires  in  federal  buildings  and  facilities  could  be 
used  to  identify  important  fire  safety  solutions  that  could  be  transferred  to  the  public  at 
large  to  reduce  potentially  the  significant  fire-related  loss  of  life  and  property  that  occurs 
in  the  United  States. 
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6. 


Fire  Sprinkler  System  Maintenance  and  Reliability 


In  nearly  all  the  modeled  events,  the  automatic  fire  sprinkler  systems  controlled 
the  fires  and  kept  the  results  within  the  parameters  of  the  GSA’s  federal  fire  safety 
regulations.  During  a  four- year  study,  the  NFPA  found  that  where  office  buildings121 
were  protected  by  automatic  sprinkler  systems,  the  systems  operated  effectively  95%  of 
the  time  and  confined  the  fire  to  the  room  of  origin  in  94%  of  events  (number  of  reported 
fires  =  1,170)  (Hall,  2010b).  In  those  cases  where  the  sprinklers  failed  to  control  the  fire, 
64%  of  the  failures  were  attributed  to  the  systems  being  shut  off,  17%  due  to  lack  of 
maintenance,  and  the  balance  were  the  result  of  a  variety  of  other  impairments  (Hall, 
2010b).  Given  the  success  rate  of  properly  operating  sprinkler  systems,  research  should 
be  conducted  on  methods  to  enhance  system  reliability  through  regular  inspection,  testing 
and  maintenance,  and  the  implementation  of  impairment  control  programs.  The  technical 
response  of  sprinkler  effectiveness  seems  evident;  the  research  should  be  conducted  to 
identify  human  failures  that  resulted  in  ineffective  perfonnance. 

7.  Perimeter  Security  Enhancements 

Results  from  the  Delphi  survey  of  fire  investigation  experts  indicated  a  strong 
correlation  between  opportunistic  break-ins  and  fires  in  federal  buildings.  Additional 
research  on  the  efficacy  of  perimeter  security  countenneasures  may  yield  data 
recommending  added  protection  from  adversaries  through  enhanced  human,  visual, 
kinetic,  or  other  technological  security  regimes,  which  may  prove  to  be  a  cost-effective 
solution  to  fire  threats,  if  prompt  response  from  law  enforcement  or  facility  security 
personnel  can  interrupt  these  attacks. 

8.  Federal  Building  Safety  Analysis 

A  key  theme  of  this  report  is  the  need  to  improve  the  level  of  detail  and  definition 
so  event  outcomes  can  be  measured.  One  area  that  could  use  improvement  is  in  the 
federal  building  safety  analysis,  41  CFR  102-80.115,  that  states  fire  protection  strategies 

121  The  study  included  no  data  for  courthouse  buildings,  nor  does  it  discriminate  between  federal  or 
non-federal  properties. 
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are  deemed  successful  if  the  selected  method  is  able  to  keep  flames  in  the  room  of  origin. 
As  discussed  in  some  detail  in  the  pass-fail  criteria  of  the  previous  unit,  the  varying 
interpretations  of  flame  characteristics  and  their  consequences  may  result  in  inconsistent 
application  of  this  criterion.  Since  flames  represent  visual  constituents  of  products  of 
combustion,  and  perhaps  more  importantly,  are  dramatically  thennodynamic,  the 
detennination  of  whether  the  flames  left  the  room  of  origin  is  highly  subjective  based  on 
the  viewers’  perception.  According  to  the  CFR  criteria,  even  if  a  transient  flame  left  the 
room  of  origin  but  had  no  consequence  on  people  or  objects,  the  fire  safety  strategy 
would  not  be  rendered  successful. 

Furthennore,  the  conditions  under  which  the  room  enclosure  exists  at  the  time  of 
fire  ignition  should  be  defined.  Flames  are  more  likely  to  leave  a  room  with  open  vents 
(windows  or  doors)  than  one  in  which  these  vents  are  closed. 

9.  Performance-Based  Design  Applications  to  Other  Threats 

This  thesis  contends  that  given  adequate  scenario  infonnation,  perfonnance-based 
design  methods  can  effectively  proposed  and  evaluate  temporary  or  pennanent 
countermeasures  against  arson  threats.  Can  the  design  methods  be  applied  to  other 
threats?  Given  the  3 1  different  threat  scenarios  outlined  in  the  DBT,  it  would  be  well  to 
know  if  the  performance-based  design  methods  are  universally  applicable  to  a  growing 
and  varied  number  of  threat  conditions. 

Furthermore,  existing  detenninistic  modeling  software  packages  for  fire  and  life 
safety  analysis  have  not  been  validated  for  other  threat  scenarios.  Research  should  be 
conducted  to  inventory  and  analyze  for  effectiveness  the  wide  variety  of  modeling 
products  that  exist  to  address  specific  threats,  such  as  explosive  and  IED  blasts,  vehicle- 
borne  improvised  explosive  devices,  CBRN  dispersion,  bio-contamination  and  vector 
distribution,  infectious  disease  communicability,  and  even  network  and  supervisory 
control  and  data  acquisition  (SCAD A)  cyberthreats. 
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E.  POLICY  RECOMMENDATION  DERIVED  FROM  CONCLUSIONS 

The  DHS  ISC’s  2012  Physical  Security  Criteria  for  Federal  Facilities  standard 
establishes  a  baseline  set  of  physical  security  criteria  to  be  applied  to  federal  buildings 
and  facilities  under  its  jurisdiction.  It  uses  a  risk  assessment  model  (Figure  3)  to  guide 
users  through  a  decision-making  process  for  evaluating  the  levels  of  building  and  facility 
protection  from  a  variety  of  threats.  The  foundation  of  the  risk  assessment  model  is  found 
in  a  “Facility  Security  Level”  score  derived  from  the  2008  standard  Facility  Security 
Level  Determination  for  Federal  Facilities.  That  analysis  produced  a  “Facility  Security 
Level”  score  from  I  to  V  (low  to  critical)  depending  upon  the  facilities’  mission 
criticality,  symbolism,  population  size,  and  threat  to  tenant  agencies.  The  later  document, 
the  Physical  Security  Criteria  for  Federal  Facilities  standard,  provides  little  guidance 
other  than  a  table  of  prescriptive  solutions  on  how  to  evaluate  the  identified  threats  and 
develop  meaningful  countermeasures. 

The  adoption  and  application  of  performance-based  design  methods — including 
qualification  and  quantification  of  the  threats,  and  clear  articulation  of  the  existing  or 
proposed  countermeasures — would  provide  those  responsible  for  risk  assessment  blind 
predictions  of  potential  outcomes.  Consequently,  a  revised  ISC  risk  assessment  model  is 
proposed  to  incorporate  the  precepts  of  performance-based  design  at  two  decision  points 
in  the  process  (see  Figure  34:  Proposed  ISC  Risk  Assessment  Model).  In  the  suggested 
model,  perfonnance-based  design  methods  are  added  at  Step  3  (Determine  the  LOP 
needed  to  meet  risk)  and  Step  5  (Detennine  the  highest  achievable  LOP).  Results  from 
well-qualified  and  quantified  performance-based  design  analysis  would  provide  decision 
makers  on  the  federal  FSC  (or  even  those  in  the  design  and  procurement  process)  a  level 
of  confidence  in  the  existing  LOP  or  the  proposed  interim  and  pennanent 
countenneasures  because  their  perfonnance  has  been  evaluated  against  specific  threats. 

The  Physical  Security  Criteria  for  Federal  Facilities  standard  risk  assessment 
model  (Figure  3)  compels  the  FSC  to  identify  and  assess  risks  (e.g.,  threat  plus 
consequence  plus  vulnerability)  against  all  the  29  so-called  “undesirable  events”  listed  in 
the  standard.  The  companion  document,  the  DBT  ,  includes  3 1  threat  scenarios,  some  of 
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which  overlap  the  “undesirable  events”  list.  These  scenarios  (Appendix  B)  have  been 
shown  to  be  so  vague  that  an  effective  evaluation  of  countermeasures  is  impossible. 

Step  3  in  Figure  34  is  a  decision  point  where  the  FSC  is  compelled  to  choose  if 
the  existing  LOPs  (countenneasures)  are  commensurate  with  the  risk.  The  only  guidance 
provided  to  the  FSC  is  “the  security  organization  should  detennine  whether  the 
countenneasures  contained  in  the  baseline  LOP  [levels  of  protection]  adequately  mitigate 
known  or  anticipated  risks  to  the  facility”  (U.S.  Department  of  Homeland  Security, 
2010b,  pp.  21-22).  By  adequately  quantifying  the  anticipated  threats  and  the  known 
countenneasures  (e.g.,  existing  conditions),  and  employing  suitable  detenninistic 
modeling  software,  the  FSC  could  anticipate  with  some  level  of  confidence  the  building 
or  facility’s  ability  to  resist  the  threats. 

A  second  opportunity  exists  in  the  risk  assessment  model  to  employ  performance- 
based  design  methods.  At  Step  5  in  Figure  34,  the  FSC  has  detennined  that  the  existing 
LOP  is  inadequate  and  must  determine  what  must  be  accomplished  to  accept  or  reject  the 
risks.  The  performance-based  design  approach  of:  1)  qualifying  and  quantifying  the 
design  threat  scenarios,  2)  modeling  design  scenarios  with  proposed  countermeasures, 
and  3)  using  the  outcomes  to  evaluate  perfonnance  in  line  with  satisfactorily  managing 
the  risks,  provides  another  opportunity  for  improved  security. 
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Figure  34.  Proposed  ISC  Risk  Assessment  Model 
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F. 


CONCLUSION 


This  thesis  evaluates  the  application  of  performance-based  design  methods  to  the 
Physical  Security  Criteria  for  Federal  Facilities  standard  to  address  the  specific  threat  of 
arson  to  federal  buildings  and  facilities.  It  proposes  a  new  model  for  physical  security 
risk  assessment  that  incorporates  perfonnance-based  design  methods  at  two  decision 
points  to  help  officials  make  rational  judgments  regarding  security  countermeasure  based 
on  an  analysis  of  the  proposed  threat. 

The  strategic  implications  of  this  model  for  homeland  security  include, 
specifically,  improving  fire  and  life  safety  in  federal  buildings  and  facilities,  and 
eventually  providing  a  model  construct  for  hardening  federal  targets  from  a  variety  of 
threats,  enhancing  federal  continuity  of  operations,  and  strengthening  national  continuity 
of  government  in  the  face  of  unwanted  criminal  or  terrorist  attacks. 
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APPENDIX  A.  PUBLIC  BUILDING  DELINED 


The  Administrator  of  General  Services  is  responsible  for  the  construction  and 
maintenance  of  public  buildings.  According  to  Title  40,  U.S.C.  Subtitle  II  Part  A  Chapter 
33  Section  3301,  the  term  “public  building”  means  a  building,  whether  for  single  or 
multitenant  occupancy,  and  its  grounds,  approaches,  and  appurtenances,  which  is 
generally  suitable  for  use  as  office  or  storage  space  or  both  by  one  or  more  federal 
agencies  or  mixed-ownership  government  corporations. 

In  the  law,  public  buildings  include  federal  office  buildings,  post  offices, 
customhouses,  courthouses,  appraisers’  stores,  border  inspection  facilities,  warehouses, 
record  centers,  relocation  facilities,  telecommuting  centers,  similar  federal  facilities,  and 
any  other  buildings  or  construction  projects  that  the  President  of  the  United  States 
considers  to  be  justified  in  the  public  interest. 

The  tenn  does  not  include  those  building  or  construction  projects  on  the  public 
domain  (including  that  reserved  for  national  forests  and  other  purposes);  are  on  US 
government  property  in  foreign  countries;  are  on  Indian  and  native  Eskimo  property  held 
in  trust;  are  on  land  used  in  connection  with  federal  programs  for  agricultural, 
recreational,  and  conservation  purposes,  including  research  in  connection  with  the 
programs;  are  on  or  used  in  connection  with  river,  harbor,  flood  control,  reclamation  or 
power  projects,  for  chemical  manufacturing  or  development  projects,  or  for  nuclear 
production,  research,  or  development  projects;  are  on  or  used  in  connection  with  housing 
and  residential  projects;  are  on  military  installations  (including  any  fort,  camp,  post, 
naval  training  station,  airfield,  proving  ground,  military  supply  depot,  military  school,  or 
any  similar  facility  of  the  Department  of  Defense);  belong  to  installations  of  the 
Department  of  Veterans  Affairs  used  for  hospital  or  domiciliary  purposes;  or  the 
President  of  the  United  States  considers  to  be  excluded  from  the  public  interest  (Legal 
Infonnation  Institute,  2011c). 


227 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


228 


APPENDIX  B.  UNDESIRABLE  EVENTS  AND  DBT  SCENARIOS 


The  DBT  includes  the  following  31  threat  scenarios  (Table  50)  to  be  used  for 
threat  analysis  and  countenneasure  planning. 


Table  50.  Undesirable  Events  and  DBT  Scenarios 


Undesirable  Event 


Aircraft  as  Weapon 


_ Design  Basis  Threat  Scenarios _ 

Deliberately  crashing  a  Cessna  172  Skyhawk  (or 
similar)  into  a  facility.  The  Cessna  172’s 
characteristics  are  as  follows: 

a)  Maximum  cruise  speed:  126  knots  (233  km/h) 

b)  Maximum  takeoff  weight:  2,550  lbs  ( 1 1 57  kg) 

c)  Useable  fuel  capacity:  3 18  lbs  (144  kg) 

d)  Full  fuel  payload:  523  lbs  (237  kg) 

e)  Range:  610  mn  (1130  km) 

f)  Height:  8  ft  1 1  in  (2.72  m) 

g)  Length:  27  ft  2  in  (8.28  m) 

h)  Wingspan:  36  ft  1  in  (1 1  m) 


Arson 


An  adversary  places  an  IED  containing  an  accelerant 
and  utilizing  a  delay  mechanism  adjacent  to  a  facility, 
but  outside  the  view  of  security  countermeasures. 


Assault 


Single  assailant  anned  with  a  blunt  weapon. 


An  individual  enters  a  facility  and  begins  to  attack 
Ballistic  Attack- Active  occupants  using  multiple  handguns  or  a  handgun  and  a 

Shooter  rifle. 


An  individual  anned  with  a  rifle  fires  indiscriminately 
Ballistic  Attack-Small  Arms  at  a  facility  from  outside. 


Ballistic  Attack-Standoff 
Weapons 


An  individual  assaults  a  large  federal  building  using  a 
homemade  mortar  using  a  fused  explosive  projectile. 
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Undesirable  Event 


Breach  of  Access  Control 
Point-Covert 


Breach  of  Access  Control 
Point-Overt 


CBR  Release — External 


CBR  Release — Internal 


CBR  Release — Mailed  or 
Delivered 


CBR  Release  -  Water 
Supply 


Civil  Disturbance 


Coordinated  or  Sequential 
Attacks 


Disruption  of  Building  and 
Security  Systems 


_ Design  Basis  Threat  Scenarios _ 

An  individual  enters  a  federal  facility  with  a  large 
group  of  visitors  and  displays  a  counterfeit 
identification  badge. 

An  adversary  uses  a  handgun  in  an  effort  to  breach 
security  at  the  entrance  checkpoint  with  the  intent  to 
proceed  inside  the  facility. 

A  single  adversary  releases  chlorine  gas  in  the  area  of 
an  air  intake. 

A  single  adversary  releases  Sarin  gas  by  dispersing  it 
in  the  lobby  of  a  federal  building. 

An  envelope  containing  Ricin  is  mailed  to  a  facility. 


One  to  three  adversaries  access  on-site  potable  water 
supply  piping  at  a  valve  without  backflow  protection 
and  pump  a  highly  lethal,  tasteless,  odorless  agent  into 
the  system  under  pressure,  or, 

At  a  facility  with  large  water  storage  tanks  or 
reservoirs,  adversaries  access  the  water  supply  and 
dump  a  non-lethal  contaminant  into  the  water. 

During  a  planned  demonstration,  a  subset  of  protesters 
turns  violent  and  uses  available  on-site  materials  to 
attempt  to  breach  or  damage  the  entrance  to  a  facility. 

Assault  by  a  team  of  4-12  adversaries,  each  armed 
with  an  assault-style  rifle  and  handgun.  The  assault 
may  be  of  a  suicidal  nature  and  will  also  involve  the 
use  of  small  IEDs. 

One  to  three  adversaries  gain  access  to  the  power 
supply  to  several  of  the  building’s  Closed  Circuit 
Television  (CCTV)  cameras  with  the  intent  to  disable 
the  cameras. 
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Undesirable  Event _ Design  Basis  Threat  Scenarios _ 

A  package  approximately  the  size  of  a  shoebox 
containing  a  pipe  bomb  is  initiated  by  opening  the 
package. 

The  pipe  bomb  will  be  Polyvinyl  Chloride  (PVC)-pipe 
to  reduce  weight,  and  contain  approximately  two 
Explosive  Device — Mailed  pounds  of  black  or  smokeless  powder.  The  device  will 

or  Delivered  also  contain  added  shrapnel,  such  as  nails  or  metal  ball 

bearings.  Black  or  smokeless  powder  has  an 
approximate  TNT  equivalency  factor  of  0.55.  Two 
pounds  of  black  powder  would  have  a  TNT 
equivalency  of  1.1  pound  of  TNT. 

A  device  concealed  in  a  backpack  is  placed  near  an 
entrance  to  a  facility. 

The  IED  will  consist  of  approximately  four  pounds  of 
black  or  smokeless  powder  in  galvanized  pipe  bombs. 
The  devices  will  also  contain  added  shrapnel,  such  as 
Explosive  Device — Man-  nails  or  metal  ball  bearings.  The  device  may  also 

portable  External  contain  steel  plates  to  direct  the  force  of  the  explosion 

towards  the  entrance.  The  device  will  be  detonated  by 
a  timer  mechanism.  Black  or  smokeless  powder  has  an 
approximate  TNT  equivalency  factor  of  0.55.  Four 
pounds  of  black  powder  would  have  a  TNT 
equivalency  of  2.2  pound  of  TNT. 

A  device  concealed  in  a  backpack  is  placed  on  a  public 
area  inside  a  facility. 

The  IED  will  consist  of  approximately  four  pounds  of 
black  or  smokeless  powder  in  galvanized  pipe  bombs. 
The  devices  will  also  contain  added  shrapnel,  such  as 
Explosive  Device — Man-  nails  or  metal  ball  bearings.  The  device  may  also 

portable  Internal  contain  steel  plates  to  direct  the  force  of  the  explosion 

towards  the  entrance.  The  device  will  be  detonated  by 
a  timer  mechanism.  Black  or  smokeless  powder  has  an 
approximate  TNT  equivalency  factor  of  0.55.  Four 
pounds  of  black  powder  would  have  a  TNT 
equivalency  of  2.2  pound  of  TNT. 
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Undesirable  Event 


Design  Basis  Threat  Scenarios _ 

A  suicide/homicide  bomber  enters  an  occupied  public 
space  in  the  facility  and  detonates  a  suicide  vest. 

The  device  consists  of  five  pounds  of  TNT-equivalent 
Explosive  Device —  explosive,  activated  by  a  switch  carried  by  the 

Suicide/Homicide  Bomber  adversary.  The  type  of  explosive  is  known  to  vary 

widely.  The  device  will  also  contain  added  shrapnel, 
such  as  nails,  screws,  nuts  and  bolts,  or  metal  ball 
bearings. 

In  a  location  in  which  vehicles  are  not  subject  to 
screening  for  VBIEDs,  a  passenger  sedan  with  an 
ammonium  nitrate-based  charge  of  200  pounds  of  TNT 
equivalency  concealed  in  a  trunk,  initiated  by  a  timer 
or  other  delay  mechanism,  such  as  a  fuse. 

In  a  location  in  which  vehicles  are  subject  to  screening 
for  VBIEDs  by  use  of  physical  inspection  of  the  trunk, 
Explosive  Device — Vehicle-  passenger  compartment,  undercarriage,  etc.,  a 

Borne  IED  passenger  sedan  with  an  ammonium  nitrate -based 

charge  of  50  pounds  of  TNT  equivalency  concealed  in 
sealed  void  spaces  (door  panels,  gas  tanks,  etc.), 
initiated  by  a  timer  or  other  delay  mechanism. 

The  ammonium  nitrate  mix  is  known  to  vary,  which 
may  result  in  substantially  different  TNT  equivalency 
factors. 


Hostile  Surveillance 


Insider  Threat 


Adversaries  utilize  the  Internet  to  obtain  open  source 
material  on  a  potential  target,  and  a  team  of  two 
conducts  surveillance  from  a  nearby  pubic  location  to 
observe  specific  operational  details  of  the  target  in 
preparation  for  a  possible  attack. 

Insider  threat  acts  include  a  broad  range  of  acts,  from 
secretive  acts  of  theft  or  subtle  fonns  of  sabotage  to 
more  aggressive  and  overt  forms  of  vengeance  and 
sabotage.  The  coordination  of  insider  threats  in 
perpetration  of  any  other  undesirable  events  is  likely  to 
lead  to  a  greater  chance  of  success. 
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Undesirable  Event 

Design  Basis  Threat  Scenarios 

Two  adversaries  with  handguns  attempt  to  abduct  a 
senior  federal  employee  from  a  parking  lot  area,  or, 

Kidnapping 

In  facilities  with  a  childcare  center,  an  unarmed,  non¬ 
custodial  parent  attempts  to  enter  a  controlled  area  and 
abduct  a  child. 

Release  of  On-site 

Hazardous  Materials 

An  adversary  accesses  external  storage  tanks  of 
hazardous  materials  and  manipulates  valves  or 
connections  to  create  a  leak. 

Single  assailant  anned  with  a  semi-automatic  handgun 
confronts  an  employee  at  a  cash  window  (or  similar 
disbursement  location  where  valuables  are  stored),  or, 

Robbery 

Single  assailant  anned  with  a  knife  confronts  an 
employee  approaching  his  vehicle  in  the  rear  parking 
lot  of  the  facility. 

Theft 

Single  perpetrator  authorized  to  have  access,  using 
stealth  to  obtain  and  conceal  the  property  while 
removing  it  from  the  facility. 

Unauthorized  Entry — 

Forced 

Two  adversaries,  equipped  with  hand  tools,  including 
crowbars,  hammers,  channel  locks,  vise  grips,  and 
screwdrivers. 

Unauthorized  Entry — 
Surreptitious 

A  single  adversary  gains  entry  to  a  facility  through  an 
unsecured  door  or  window.  The  adversary  is  capable 
of  accessing  a  second-story  window  or  one-story  roof 
by  using  available  means  to  climb. 

Vandalism 

Unknown  adversaries  painted  graffiti  on  facility  walls 
or  external  assets. 

Vehicle  Ramming 

A  4,700-pound  pickup  or  sport  utility  vehicle  traveling 
at  35  miles  per  hour  attempts  to  ram  into  a  facility. 
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Undesirable  Event 

Design  Basis  Threat  Scenarios 

An  employee  under  duress  from  a  job-related  situation 
enters  the  facility  and  assaults  co-workers  using  a 
handgun,  or, 

Workplace  Violence 

Co-workers  in  the  office  get  into  a  verbal 
confrontation  resulting  in  one  physically  assaulting  the 
other. 

234 


APPENDIX  C.  CONVERSION  FACTORS 


Table  5 1 .  Common  Conversion  Factors  for  United  States  Customary  to  SI  Units  (From: 

Quintiere,  1998) 


United  States  customary  units  to  SI 

SI  to  United  States  customary 
units 

Length 

1  inch  =  25.4  millimeter 

1  millimeter  =  0.0393  inch 

1  inch  =  2.54  centimeter 

1  centimeter  =  0.3937  inch 

1  foot  =  0.3048  meter 

1  meter  =  3.2808  feet 

Area 

1  yard2  =  0.8361  meter2 

1  meter2  =  10.7639  feet2 

Mass 

1  lb  =  0.4535924  kilogram 

1  kilogram  =  2.20462  lbs 

1  oz  =  28.34952  gram 

1  gram  =  0.0022046  lb 

Density 

1  pound3  =  16.0186  kg/meter3 

1  kg/meter3  =  0.06243  pounds  per 
foot3 

Energy 

1  Btu  =  1.055056  kilojoule 

1  kilojoule  =  0.94783  Btu 

Heat 

1  Btu  =  1.055056  kilojoule 

1  kilojoule  =  0.94783  Btu 

1  calorie  =  0.004168  kilojoule 

1  kilojoule  =  238.846  cal 

1  Btu  =  251.9958  cal 

1  calorie  =  0.003968321  Btu 

Heat  release 

1  Btu/hour  =  0.293071  lwatt 

1  watt  =  3.4121  Btu/hour 

rate 

1  Btu/hour  =  0.00293071  lkilowatt 

1  kilowatt  =  3412.1  Btu/hour 

1  Btu/hour  =  2.93071  le-007  megawatt 

1  megawatt  =  3,412,142  Btu/hour 

Pressure 

1  lb/ per  inch2  =0.06804596 

1  atmosphere  =  14.69695  lbs/per 

atmosphere 

inch2 

Temperature 

1  degree  Fahrenheit  =  (°C  x  1.8)+32 

1  degree  Celsius  =  (°F  -  32)/1.8 

Table  52.  Alternative  Energy  Units 


1  British  thennal  unit  (Btu)  will  raise  1  lb  of  water  1°F  at  68°F 
1  calorie  (cal)  will  raise  one  gram  (g)  of  water  1°C  at  20°C 
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APPENDIX  D.  LITERATURE  REVIEW  CODEBOOK 


100-Literature  Source: 


101 —  Whole  Book 

102 —  Book,  Section 

103 —  Consumer  Magazine 

104 —  Professional  Journal:  peer  reviewed 

105 —  Trade  Journal:  fire  service,  building  construction  industry,  architectural  digest 

106 —  Website 

107 —  Conference  Proceedings 

108 —  Other 

200- Year:  Four-digit  code  for  year  document/article  was  published,  (n.d.,  if  no  date 
provided) 

300— Geocoding:  The  document/article  pertains  to  circumstances  specific  to  the  nation 
listed. 

301 —  Not  specific  to  geographical  location. 

302 —  Australia 

303 —  Canada 

304 —  China/Hong  Kong/Taiwan 

305 —  Denmark 

306 —  Finland 

307 —  Japan 

308 —  New  Zealand 

309 —  United  Kingdom 

310 —  United  States 

311 —  Other 

312 —  Unknown:  not  stated. 

Variables 


Ql.  Arson  was  mentioned  in  same  article  as  performance-based  design. 

0.  No 
1.  Yes 

Q2  Perfonnance  based  design  was  identified  as  a  design  solution  for  arson  mitigation 
(e.g.,  permanent  countermeasures). 


0.  No 
1.  Yes 
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Q3  If  used  as  an  assessment  method,  the  proposed  perfonnance-based  design  solution 
was  detennined  to  be: 

0.  Not  addressed/No  assessment  made 

1 .  Unsuitable 

2.  Suitable 

3.  Situation  dependent 

Q4  If  used  as  design  method,  keywords  for  the  identified/needed  facilitating  criteria 
were: 

Q5  If  used  as  a  design  method,  keywords  for  the  identified  impediments  to  using 
perfonnance  based  design  were: 

Q6  The  SFPE  Engineering  Guide  to  Performance  Based  Fire  Protection  was 
mentioned  in  article  in  relation  to  arson  mitigation. 

0.  No 
1.  Yes 

Q7  The  International  Code  Council  Performance  Code  for  Buildings  and  Facilities 
was  mentioned  in  article  in  relation  to  arson  mitigation. 

0.  No 
1.  Yes 

Q8  The  SFPE  Engineering  Guide  to  Performance  Based  Fire  Protection  was 
identified  as  an  arson  mitigation  design  method. 

0.  No 
1.  Yes 

Q9  The  International  Code  Council  Performance  Code  for  Buildings  and  Facilities 
was  identified  as  an  arson  mitigation  design  method. 

0.  No 
1.  Yes 

Q10  If  used  as  a  design  method,  the  application  of  the  SFPE  Engineering  Guide  to 
Performance  Based  Fire  Protection  performance-based  design  solution  was 
detennined  to  be: 
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0.  Not  addressed/No  assessment  made 

1 .  Unsuitable 

2.  Suitable 

3.  Situation  dependent 


Qll  If  used  as  design  method,  keywords  for  the  identified/needed  facilitating  criteria 
were: 

Q12  If  used  as  a  design  method,  keywords  for  the  identified  impediments  to  using 
perfonnance  based  design  were: 

Q13  If  used  as  a  design  method,  the  application  of  the  International  Code  Council 
Performance  Code  for  Buildings  and  Facilities  performance-based  design 
solution  was  detennined  to  be: 

0.  Unsuitable 

1 .  Not  addressed/No  assessment  made 

2.  Suitable 

3.  Situation  dependent 

Q14  If  used  as  design  method,  keywords  for  the  identified/needed  facilitating  criteria 
were: 

Q15  If  used  as  a  design  method,  keywords  for  the  identified  impediments  to  using 
performance  based  design  were: 
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